Static task
static1
Behavioral task
behavioral1
Sample
409948cbbeaf051a41385d2e2bc32fc1e59789986852e608124b201d079e5c3c.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
409948cbbeaf051a41385d2e2bc32fc1e59789986852e608124b201d079e5c3c.dll
Resource
win10v2004-20240226-en
General
-
Target
409948cbbeaf051a41385d2e2bc32fc1e59789986852e608124b201d079e5c3c
-
Size
695KB
-
MD5
ad8f36645796b44ee4e6465c8ad5ead9
-
SHA1
8be6d9f79a37c698d94c88820e2f369b50ddc811
-
SHA256
409948cbbeaf051a41385d2e2bc32fc1e59789986852e608124b201d079e5c3c
-
SHA512
9f5ea6cc1781104d462d472cc8b41433dc53badb5028f5564637367d225419618cd130032eb0440e44d14183ffdf81f45e92d8a33cc0f6184ee0c3c0a364f7a4
-
SSDEEP
12288:bLi5Zs5G5RcVz4MszXXJ/o87APYinycKNfHQ8slIrrksJkwO7sbGm4+GA2Al0nFg:bLiCecl4jJLcP7n8NfHUl+ksJkwssbGW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 409948cbbeaf051a41385d2e2bc32fc1e59789986852e608124b201d079e5c3c
Files
-
409948cbbeaf051a41385d2e2bc32fc1e59789986852e608124b201d079e5c3c.dll windows:5 windows x86 arch:x86
91927ac03b8585021868c3c375d96b62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateDirectoryW
GetTickCount
WriteFile
CopyFileW
GetModuleFileNameW
InterlockedDecrement
GetStartupInfoW
GetCurrentDirectoryW
CloseHandle
CreateThread
CreateFileW
CreateProcessW
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
RtlUnwind
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
DecodePointer
GetCommandLineA
ExitThread
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
IsProcessorFeaturePresent
LCMapStringW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetModuleFileNameA
advapi32
GetUserNameW
ole32
CoInitializeEx
CoCreateInstance
oleaut32
SysStringByteLen
SysAllocString
VariantClear
SysAllocStringByteLen
VariantInit
SysFreeString
secur32
GetUserNameExW
wininet
InternetOpenW
InternetReadFile
InternetConnectW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
Sections
.text Size: 609KB - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ