ReaperPluginEntry
Static task
static1
Behavioral task
behavioral1
Sample
d843977a7666002fac3e499d95b536ff.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d843977a7666002fac3e499d95b536ff.dll
Resource
win10v2004-20240226-en
General
-
Target
d843977a7666002fac3e499d95b536ff
-
Size
162KB
-
MD5
d843977a7666002fac3e499d95b536ff
-
SHA1
519e2a21fbdd79bef095c1e424299f9b9efd8a7a
-
SHA256
a9ff999893118d14b73979d5f900494132db92b81c0d83af86ea6b368d71a262
-
SHA512
5d540f9be64521104a92d19c8313a07feeff7c92dae59bf53494e0a8f6d436f8302bcc0c2bd0f6cba526f1810525c54d907708451ef905596fd3dbd9fa737c91
-
SSDEEP
3072:XFtbTYwQWeJNwOUhxniehY2m8Q20bqpLRhhk7z0zDyDe+6U/x:1tPYbNwOUhhieG2u20mpljzDyDz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d843977a7666002fac3e499d95b536ff
Files
-
d843977a7666002fac3e499d95b536ff.dll windows:4 windows x86 arch:x86
10e6f0652c4dba9303227cc325f12daf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
GetModuleFileNameA
DeleteFileA
GetTempFileNameA
GetTempPathA
MultiByteToWideChar
GetVersion
CloseHandle
UnmapViewOfFile
WaitForSingleObject
GetFileSize
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetLastError
SetFilePointer
ReadFile
lstrcpynA
GetOverlappedResult
ResetEvent
CreateEventA
MapViewOfFile
CreateFileMappingA
CreateFileA
CreateFileW
WriteFile
GetPrivateProfileStructA
GetPrivateProfileIntA
WritePrivateProfileStructA
WritePrivateProfileStringA
GetTickCount
DeleteFileW
DisableThreadLibraryCalls
user32
SetWindowTextW
SetWindowTextA
IsDlgButtonChecked
SetWindowLongA
GetWindowLongA
EndDialog
SetDlgItemTextA
DialogBoxParamA
SendDlgItemMessageA
SendMessageA
GetDlgItem
EnableWindow
ShowWindow
CreateDialogParamA
CheckDlgButton
shell32
ShellExecuteA
msvcrt
memset
memcpy
_stat
_stricmp
_strdup
_adjust_fdiv
_initterm
_onexit
__dllonexit
pow
sin
cos
tan
free
malloc
realloc
fclose
fwrite
fread
fseek
fopen
_wfopen
memmove
??3@YAXPAX@Z
qsort
bsearch
??2@YAPAXI@Z
_wstat
sprintf
_purecall
strtol
strtoul
floor
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ