ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
49a6dad486c203ddf01291455c4a9dbdfa3286836e5e91d1300d2a814eca165d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
49a6dad486c203ddf01291455c4a9dbdfa3286836e5e91d1300d2a814eca165d.dll
Resource
win10v2004-20231215-en
General
-
Target
49a6dad486c203ddf01291455c4a9dbdfa3286836e5e91d1300d2a814eca165d
-
Size
540KB
-
MD5
5eb42e1ba99face02ce50ea1aaf72ab5
-
SHA1
b3e3bc479fff747c33f3ee60674b3072c637f506
-
SHA256
49a6dad486c203ddf01291455c4a9dbdfa3286836e5e91d1300d2a814eca165d
-
SHA512
06d2bef4a1e82835ca300437bb83b61e8dc586de71d65f748687bffd4a806f27fd835add42abc955e04b431b37586260de9573f81292cc793c3829af0c31ccda
-
SSDEEP
12288:mq332RMHVb3adyj5qhIVz6xtbGIdA+5GQH+gBiW8pVTzGufnAc7IWf:mq332RMHVb3adyj5qhg6L7negBiBpBzT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49a6dad486c203ddf01291455c4a9dbdfa3286836e5e91d1300d2a814eca165d
Files
-
49a6dad486c203ddf01291455c4a9dbdfa3286836e5e91d1300d2a814eca165d.dll windows:6 windows x86 arch:x86
0706ce37cb6e0e502bac493b1ff2d2e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileW
GetFileAttributesW
K32GetProcessImageFileNameW
GetSystemDirectoryW
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
SetCurrentDirectoryW
CreateProcessW
CopyFileW
GetDiskFreeSpaceExA
MoveFileW
OutputDebugStringA
CreateMutexA
GetVolumeInformationA
GetFileSizeEx
HeapFree
GetCurrentProcess
WaitForSingleObject
GetVersionExW
MultiByteToWideChar
GetLastError
FileTimeToSystemTime
LoadLibraryW
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GetComputerNameA
WriteConsoleW
FindClose
SetFilePointer
SetErrorMode
CreatePipe
GetDriveTypeA
WriteFile
FindNextFileW
SetHandleInformation
FindFirstFileW
GetOEMCP
ReadFile
GetStartupInfoW
OpenMutexA
GetACP
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetStringTypeW
WaitForSingleObjectEx
SwitchToThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
RaiseException
GetFileAttributesExW
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameA
OpenProcessToken
DuplicateTokenEx
LookupAccountSidW
GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerA
CreateProcessAsUserW
shell32
SHGetFileInfoW
ws2_32
gethostname
setsockopt
closesocket
WSAStartup
send
socket
connect
recv
htons
gethostbyname
inet_addr
shlwapi
PathFileExistsW
Exports
Exports
Sections
.text Size: 405KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ