load
Static task
static1
Behavioral task
behavioral1
Sample
efaa30bef6327ca8123e5443aa831dd7173de8ac9a016aaa2ae878641f85f952.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
efaa30bef6327ca8123e5443aa831dd7173de8ac9a016aaa2ae878641f85f952.dll
Resource
win10v2004-20240319-en
General
-
Target
efaa30bef6327ca8123e5443aa831dd7173de8ac9a016aaa2ae878641f85f952
-
Size
317KB
-
MD5
80397808492e12b83e5c9f5467740fd7
-
SHA1
04951144dc621f5f7ff2d66c8bcb710b77cc3d55
-
SHA256
efaa30bef6327ca8123e5443aa831dd7173de8ac9a016aaa2ae878641f85f952
-
SHA512
bdabfb83a94621f3b86ad9fb4253c2f0ca647c38da498c955e195114831db419c89b4845a5c0a0e67ae3689185942b08347a5d31f0ce0699010ae872a7eff5c6
-
SSDEEP
6144:9JgA8K7SyxEx7rMC8pvf9Ol/kqFjheTBePAOuvB:9JgA8K7K7h8Jf9OaqveTwP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efaa30bef6327ca8123e5443aa831dd7173de8ac9a016aaa2ae878641f85f952
Files
-
efaa30bef6327ca8123e5443aa831dd7173de8ac9a016aaa2ae878641f85f952.dll windows:5 windows x86 arch:x86
6ef968f30bbfa10ed97d34d01e1793de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
GetUserNameW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey
OpenProcessToken
CreateProcessAsUserW
RegOpenKeyW
RegDeleteValueW
user32
GetSystemMetrics
wsprintfW
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
iphlpapi
GetAdaptersInfo
ws2_32
WSARecvFrom
setsockopt
bind
socket
closesocket
WSASendTo
ntohs
htonl
freeaddrinfo
getnameinfo
inet_ntoa
WSAStartup
WSAGetLastError
WSALookupServiceBeginA
WSACleanup
WSALookupServiceEnd
WSALookupServiceNextA
ntohl
getaddrinfo
getsockname
shell32
ShellExecuteW
urlmon
URLDownloadToFileW
kernel32
CreateFileA
GetModuleHandleA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
GetACP
FindFirstFileW
lstrlenW
FindClose
FindNextFileW
GetEnvironmentVariableW
CreateDirectoryW
WriteFile
ReadFile
CreateFileW
OutputDebugStringA
CloseHandle
GlobalMemoryStatus
GetNativeSystemInfo
GetDriveTypeW
GetCurrentProcess
GetComputerNameW
GetModuleHandleW
GlobalAlloc
GetVersionExW
GetSystemDirectoryA
MultiByteToWideChar
GetProcAddress
GlobalFree
GetDiskFreeSpaceExW
FreeLibrary
VirtualFree
IsBadReadPtr
VirtualAlloc
LoadLibraryA
VirtualProtect
ExitProcess
SetErrorMode
CreateProcessW
MoveFileExW
OutputDebugStringW
OpenProcess
WideCharToMultiByte
LoadLibraryW
Sleep
TerminateProcess
GetModuleFileNameW
GetLastError
Process32FirstW
LocalAlloc
RemoveDirectoryW
Process32NextW
CreateToolhelp32Snapshot
DeleteFileW
LocalFree
lstrcpyW
CreateThread
CreateMutexW
TlsGetValue
WaitForSingleObject
SetEvent
TlsSetValue
OpenThread
CreateEventW
GetCurrentThreadId
ReleaseMutex
TlsAlloc
TlsFree
QueryPerformanceCounter
GetTickCount
GetCurrentThread
FormatMessageW
QueryPerformanceFrequency
SetThreadAffinityMask
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
SetLastError
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
Exports
Exports
Sections
.text Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ