ServiceCrtMain
Static task
static1
Behavioral task
behavioral1
Sample
6f482c8bf7d17a80353d08c9a3ed4ff2d0c7f035be1804dfc6d1d23f738304f7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f482c8bf7d17a80353d08c9a3ed4ff2d0c7f035be1804dfc6d1d23f738304f7.dll
Resource
win10v2004-20240226-en
General
-
Target
6f482c8bf7d17a80353d08c9a3ed4ff2d0c7f035be1804dfc6d1d23f738304f7
-
Size
52KB
-
MD5
d98b1a64359a642458e5a139cb3d1673
-
SHA1
57e7c7ba9e9d63496296c77ac9da8232ab52178b
-
SHA256
6f482c8bf7d17a80353d08c9a3ed4ff2d0c7f035be1804dfc6d1d23f738304f7
-
SHA512
f08d1a00b13af2c12cdb2e848a22aa086b584d9d657daaadc95c121e30c23f22a98780d6444ebc343a652272526089d3f14b9d57ce5d2e084dc2eba3af098b29
-
SSDEEP
1536:ObHmrPxGqlCeJ7TEefJMH6X2HTPmwMNo:e6JpCoTnf/X2HKwMNo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f482c8bf7d17a80353d08c9a3ed4ff2d0c7f035be1804dfc6d1d23f738304f7
Files
-
6f482c8bf7d17a80353d08c9a3ed4ff2d0c7f035be1804dfc6d1d23f738304f7.dll windows:5 windows x86 arch:x86
8dd240698cdc59c6c13d0fb529b04593
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleFileNameW
GetSystemDirectoryA
CreateFileW
VirtualProtectEx
VirtualAllocEx
GetProcessHeap
CreateEventW
lstrcatW
VirtualProtect
CloseHandle
WriteProcessMemory
CreateThread
WaitForSingleObject
HeapAlloc
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetThreadContext
CreateFileMappingW
ExitProcess
FlushFileBuffers
IsProcessorFeaturePresent
GetStringTypeW
GetLastError
HeapFree
GetProcAddress
GetModuleHandleW
DecodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapCreate
HeapDestroy
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
HeapSize
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
LCMapStringW
advapi32
SetServiceStatus
StartServiceW
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
OpenSCManagerW
CloseServiceHandle
CreateServiceW
RegisterServiceCtrlHandlerW
Exports
Exports
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ