maggie
Static task
static1
Behavioral task
behavioral1
Sample
7adbf934329be31a9de64668d75b2c710e08e791fd01d5c2436d887f0327ea34.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7adbf934329be31a9de64668d75b2c710e08e791fd01d5c2436d887f0327ea34.dll
Resource
win10v2004-20240226-en
General
-
Target
7adbf934329be31a9de64668d75b2c710e08e791fd01d5c2436d887f0327ea34
-
Size
239KB
-
MD5
6a99c186f09770bf80121a836dba1179
-
SHA1
96099015981559237a52a7d50a07143870728fd0
-
SHA256
7adbf934329be31a9de64668d75b2c710e08e791fd01d5c2436d887f0327ea34
-
SHA512
05893dd58b129773a811d86e6a88109143d3b99f4c18d542614028a81106f8271d8fba2ad44954a19fb01eaf1162dbcb121160a1970078949afe1c5623ee37e7
-
SSDEEP
3072:T3MeMvL2Hm5qz0kpzmOFnGlm4fX8l570Didw0+q+p5gNND4zwI8xSlksjlHCjg1r:wpLLi3pzm8Glmk8l5YD0+q+rIftB9dk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7adbf934329be31a9de64668d75b2c710e08e791fd01d5c2436d887f0327ea34
Files
-
7adbf934329be31a9de64668d75b2c710e08e791fd01d5c2436d887f0327ea34.dll windows:5 windows x64 arch:x64
cfd02dd9d942bd97f7772b2e0669acfe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FlsFree
FlsGetValue
WideCharToMultiByte
GetCurrentProcessId
GlobalMemoryStatusEx
VirtualQueryEx
VirtualProtectEx
SuspendThread
VirtualFree
GetThreadContext
SetThreadContext
FlushInstructionCache
SetFileAttributesA
DeleteFileA
GetEnvironmentVariableA
CreateProcessA
ReadFile
FindNextFileA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
CreatePipe
MultiByteToWideChar
DuplicateHandle
GetModuleFileNameA
GetCurrentThread
OutputDebugStringA
Sleep
IsBadReadPtr
GetVersionExA
GetSystemInfo
LocalFree
GlobalFree
CreateThread
WaitForSingleObject
GetSystemDirectoryA
GetTickCount
WriteFile
SetFilePointer
GetLastError
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
CreateFileA
DeviceIoControl
CloseHandle
GlobalAlloc
FindFirstFileA
FindClose
ResumeThread
VirtualAlloc
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryExW
DecodePointer
EncodePointer
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
FlsSetValue
GetCurrentThreadId
RtlLookupFunctionEntry
RtlUnwindEx
FlsAlloc
RaiseException
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
lstrlenA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapReAlloc
IsValidCodePage
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetStdHandle
ExitProcess
GetModuleHandleW
HeapDestroy
HeapCreate
HeapSetInformation
SetLastError
user32
SetProcessWindowStation
GetSystemMetrics
SetUserObjectSecurity
OpenWindowStationA
GetUserObjectInformationA
GetProcessWindowStation
CloseDesktop
CloseWindowStation
PostMessageA
SetTimer
KillTimer
DefWindowProcA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
OpenDesktopA
GetUserObjectSecurity
CharLowerBuffA
advapi32
RegCreateKeyExA
RegSetValueExA
StartServiceA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
LogonUserW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
CreateProcessWithTokenW
CreateProcessWithLogonW
LookupAccountNameA
AddAccessAllowedAce
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAce
CopySid
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetAclInformation
GetAce
IsValidSid
GetSecurityDescriptorDacl
GetFileSecurityA
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
LookupAccountSidA
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoUninitialize
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
odbc32
ord41
ord43
ord11
ord18
ord13
ord27
ord4
ord36
ord9
ord31
ord24
ord75
ord39
opends60
ord42
ord41
ord26
ord25
ord40
ws2_32
WSASocketA
socket
htons
inet_addr
connect
__WSAFDIsSet
recv
send
closesocket
WSASetLastError
WSAStartup
setsockopt
WSAEventSelect
listen
bind
htonl
shutdown
WSAAccept
WSASendTo
WSASend
getsockname
WSARecv
WSARecvFrom
WSACleanup
WSAAsyncSelect
inet_ntoa
getpeername
WSAGetLastError
inet_ntop
WSAIoctl
gethostbyname
WSAAsyncGetHostByName
gethostname
ioctlsocket
select
wininet
InternetConnectA
InternetReadFile
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCrackUrlA
InternetOpenA
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
gdi32
GetStockObject
Exports
Exports
Sections
.text Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ