DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a8f3bc45ac0dcf351c028ecabfd68e8e551cd97f8dc0fc6e62e135668cde9277.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a8f3bc45ac0dcf351c028ecabfd68e8e551cd97f8dc0fc6e62e135668cde9277.dll
Resource
win10v2004-20240226-en
General
-
Target
a8f3bc45ac0dcf351c028ecabfd68e8e551cd97f8dc0fc6e62e135668cde9277
-
Size
964KB
-
MD5
e94689378ce3de9e41b8fd4bcba28eaf
-
SHA1
e21901921fd235d4880786564fcb679683703d88
-
SHA256
a8f3bc45ac0dcf351c028ecabfd68e8e551cd97f8dc0fc6e62e135668cde9277
-
SHA512
c77ca4eb12a7ca86984a8cad2ad1348d6e30e57de64603ca8971120bb7bd118998c9f53d9ea0a0427bc426a8d73df9bb0ebdaa3cbaa39f93d53346f197929cf8
-
SSDEEP
12288:0FdNWub5Hii/uuQpEhe4Nl8WJCgxKRNfCEbHaB:8Vre4Nl8WJdxGN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8f3bc45ac0dcf351c028ecabfd68e8e551cd97f8dc0fc6e62e135668cde9277
Files
-
a8f3bc45ac0dcf351c028ecabfd68e8e551cd97f8dc0fc6e62e135668cde9277.dll regsvr32 windows:6 windows x86 arch:x86
94c7e221fdc186581f167ea18173b8da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
lstrcmpW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
CloseHandle
Sleep
TerminateProcess
OpenProcess
lstrcmpiW
lstrcpyW
lstrcatW
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
GetLastError
GetModuleFileNameA
lstrcpyA
lstrlenA
CreateFileA
CreateFileW
DeleteFileA
GetFileAttributesA
GetFileSize
ReadFile
GetModuleHandleA
WriteFile
Process32First
Process32Next
GetTickCount
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetVolumeInformationW
DeviceIoControl
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
TerminateThread
CopyFileW
CreateMutexW
GetTempPathW
OpenMutexW
GetModuleHandleW
ReadDirectoryChangesW
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
DecodePointer
EnumSystemLocalesW
GetUserDefaultLCID
GetModuleFileNameW
CreateProcessW
ExitProcess
GetCurrentProcessId
SetFilePointer
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
GetModuleHandleExW
HeapValidate
GetSystemInfo
GetCurrentThread
GetStdHandle
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
HeapReAlloc
HeapSize
HeapQueryInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
ReadConsoleW
user32
RegisterClassW
CreateWindowExW
PostMessageA
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
DefWindowProcA
advapi32
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
shell32
SHFileOperationW
shlwapi
PathIsDirectoryA
Exports
Exports
Sections
.text Size: 760KB - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 1024B - Virtual size: 905B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ