DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
180a2f3eb004f93590e4fb18cdc3dd6e18815587637ac354ca99f7513aa63633.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
180a2f3eb004f93590e4fb18cdc3dd6e18815587637ac354ca99f7513aa63633.dll
Resource
win10v2004-20240226-en
General
-
Target
180a2f3eb004f93590e4fb18cdc3dd6e18815587637ac354ca99f7513aa63633
-
Size
957KB
-
MD5
299f8d3942315f7bd8c17b9531986c0c
-
SHA1
542b866c6c23b7b4fceb2d78dbdd8ff0d43a9115
-
SHA256
180a2f3eb004f93590e4fb18cdc3dd6e18815587637ac354ca99f7513aa63633
-
SHA512
997c6dff401db419fe9be6806fa70819115969c9879256d0184a6ba07f84c44a2c5fe335a0e2a00be66d2170e3eafda12cf388c763165d8a105b29c25511f094
-
SSDEEP
12288:g2kflEyz9M9vpii5uuZ43evtQgzWEUamsvlgTRFZa8UZeXgZRKX:ZSmprWEUamsvlG7a8aeqKX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 180a2f3eb004f93590e4fb18cdc3dd6e18815587637ac354ca99f7513aa63633
Files
-
180a2f3eb004f93590e4fb18cdc3dd6e18815587637ac354ca99f7513aa63633.dll regsvr32 windows:6 windows x86 arch:x86
4d16232cca7a31ae3eb93dc796cbc801
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
Sleep
GetCurrentProcessId
TerminateProcess
OpenProcess
lstrcmpW
lstrcpyW
lstrcatW
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
GetLastError
GetModuleFileNameA
GetModuleFileNameW
lstrcpyA
lstrlenA
CreateFileA
CreateFileW
DeleteFileA
GetFileAttributesA
GetFileAttributesW
GetFileSize
ReadFile
SetFilePointer
WriteFile
lstrcmpiW
SetFileAttributesW
Process32Next
GetTickCount
GetLogicalDriveStringsW
GetVolumeInformationW
DeviceIoControl
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
TerminateThread
CopyFileW
CreateMutexW
ExitProcess
GetTempPathW
CreateProcessW
OpenMutexW
GetModuleHandleW
ReadDirectoryChangesW
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
DecodePointer
HeapQueryInformation
HeapSize
FindNextFileW
FindFirstFileW
FindClose
Process32First
DeleteFileW
ReadConsoleW
HeapReAlloc
SetEnvironmentVariableW
FreeEnvironmentStringsW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
QueryPerformanceCounter
InitializeSListHead
GetStartupInfoW
RtlUnwind
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
GetModuleHandleExW
HeapValidate
GetSystemInfo
GetCurrentThread
GetStdHandle
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
user32
RegisterClassW
DefWindowProcA
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
PostMessageA
advapi32
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
shell32
SHFileOperationW
shlwapi
PathIsDirectoryA
Exports
Exports
Sections
.text Size: 753KB - Virtual size: 753KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 1024B - Virtual size: 882B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ