RegisterModule
Static task
static1
Behavioral task
behavioral1
Sample
b9a9e43e3d10cf6b5548b8be78e01dc0a034955b149a20e212a79a2cf7bee956.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9a9e43e3d10cf6b5548b8be78e01dc0a034955b149a20e212a79a2cf7bee956.dll
Resource
win10v2004-20240226-en
General
-
Target
b9a9e43e3d10cf6b5548b8be78e01dc0a034955b149a20e212a79a2cf7bee956
-
Size
181KB
-
MD5
acdae8914ed98213f10518fe657f87bb
-
SHA1
8f18618ca9084506d26b84330629c844a226f2ff
-
SHA256
b9a9e43e3d10cf6b5548b8be78e01dc0a034955b149a20e212a79a2cf7bee956
-
SHA512
53033d6565da95507b78aaaffcfbe0297f90cf855bf42dd991ddbff4907d5321c38ba873cc3e991d3a997599827cb861e16782758312e315a1b770121605639f
-
SSDEEP
3072:9JvozPbN/x7eT8VviMEgRQRjJAM50CfitjLled+4NJAjKrEn0cw:ToLbaT8V6MEhZGMaHtn4dXvi0c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9a9e43e3d10cf6b5548b8be78e01dc0a034955b149a20e212a79a2cf7bee956
Files
-
b9a9e43e3d10cf6b5548b8be78e01dc0a034955b149a20e212a79a2cf7bee956.dll windows:5 windows x64 arch:x64
18774e3e9ca709e145eaf821cf5d3b21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
PeekNamedPipe
WaitForSingleObject
CreateProcessA
TerminateProcess
ReadFile
MultiByteToWideChar
GetStartupInfoA
GetLastError
CreatePipe
OutputDebugStringA
CloseHandle
DebugBreak
SetEndOfFile
GetTimeZoneInformation
CreateFileW
GetCurrentDirectoryW
GetFullPathNameW
GetFileInformationByHandle
FileTimeToLocalFileTime
HeapReAlloc
LCMapStringW
CompareStringW
GetStringTypeW
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
SetLastError
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
DeleteFileW
HeapSize
ReadConsoleW
SetFilePointerEx
GetFileType
GetStartupInfoW
FindClose
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
ws2_32
ioctlsocket
WSAIoctl
connect
inet_ntoa
inet_addr
select
WSAGetLastError
htons
getsockname
setsockopt
recv
socket
__WSAFDIsSet
WSASetLastError
closesocket
gethostbyname
send
getsockopt
Exports
Exports
Sections
.text Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ