MyStart
Static task
static1
Behavioral task
behavioral1
Sample
5fff707b7cd9a6ecfe5d120480af23b1ef0f0d64db3b0c434b5c74b39841e44b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5fff707b7cd9a6ecfe5d120480af23b1ef0f0d64db3b0c434b5c74b39841e44b.dll
Resource
win10v2004-20240226-en
General
-
Target
5fff707b7cd9a6ecfe5d120480af23b1ef0f0d64db3b0c434b5c74b39841e44b
-
Size
70KB
-
MD5
9bd6f6c93dbe4f77adba98a547167214
-
SHA1
4b30766c6b88d437fb2ba18ef50467bd280ceb23
-
SHA256
5fff707b7cd9a6ecfe5d120480af23b1ef0f0d64db3b0c434b5c74b39841e44b
-
SHA512
26ef7447134df2abd98c720f4b4ec9b892466c42783cbe828669cfc1f46745aca566700e0e92a0c5c9be7186bcc68083fba94b800cf9dcc9a1beab7423768d31
-
SSDEEP
1536:N1DNRG97zFFsqrsYZB1atTrFZC2Re+IwM3VJejes8p:7DuJpF33H18oTpsSs8p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fff707b7cd9a6ecfe5d120480af23b1ef0f0d64db3b0c434b5c74b39841e44b
Files
-
5fff707b7cd9a6ecfe5d120480af23b1ef0f0d64db3b0c434b5c74b39841e44b.dll windows:4 windows x86 arch:x86
65ab8312656177202b4410ce3a5cdbb1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegCloseKey
RegSetValueExA
RegOpenKeyExA
CloseEventLog
ReadEventLogA
GetOldestEventLogRecord
OpenEventLogA
ws2_32
closesocket
WSAGetLastError
send
recv
select
socket
inet_addr
htons
gethostbyname
connect
WSAStartup
shutdown
iphlpapi
GetAdaptersInfo
kernel32
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
CloseHandle
GetLastError
GetCurrentProcess
ReadFile
GetFileSize
CreateFileA
WaitForMultipleObjects
CreateEventA
Sleep
GetProfileStringA
SetFileTime
SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsA
GetModuleFileNameA
LeaveCriticalSection
GetLocalTime
EnterCriticalSection
InitializeCriticalSection
ExitProcess
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetFileTime
GetSystemDirectoryA
MoveFileA
DeleteFileA
DuplicateHandle
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
TerminateProcess
WriteFile
DisconnectNamedPipe
WriteProfileStringA
CreateProcessA
CreatePipe
Process32Next
Process32First
CreateToolhelp32Snapshot
PeekNamedPipe
SetFilePointer
WaitForSingleObject
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
RtlUnwind
GetFileAttributesA
GetTimeZoneInformation
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
TlsAlloc
TlsFree
SetLastError
TlsGetValue
UnhandledExceptionFilter
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
Exports
Exports
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ