xlAutoOpen
Static task
static1
Behavioral task
behavioral1
Sample
c532d19652ea6d4e0ebb509766de1ec594dd80152f92f7ef6b80ad29d2aa8cf4.xll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c532d19652ea6d4e0ebb509766de1ec594dd80152f92f7ef6b80ad29d2aa8cf4.xll
Resource
win10v2004-20240226-en
General
-
Target
c532d19652ea6d4e0ebb509766de1ec594dd80152f92f7ef6b80ad29d2aa8cf4
-
Size
26KB
-
MD5
1e2e2b8f1c81c01bac895e113f7a4846
-
SHA1
3bcf40b51363e2e69aacea81f700bd246fa99882
-
SHA256
c532d19652ea6d4e0ebb509766de1ec594dd80152f92f7ef6b80ad29d2aa8cf4
-
SHA512
89079fbe4618e7d90bbd0e5dc58bb7205621080382a04846f3d2c754e6b2d1bbe214bb1fc8795f343a937c3f1563eaa4c2ef2ce1ebfd9a213938f48bf408e555
-
SSDEEP
768:hC+hfKtC+hfKYTvOsVQ5dXoLCYH1yJIyg4EAXhgp:hVh2VhfqsVgdXoWYVyJ5PXhgp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c532d19652ea6d4e0ebb509766de1ec594dd80152f92f7ef6b80ad29d2aa8cf4
Files
-
c532d19652ea6d4e0ebb509766de1ec594dd80152f92f7ef6b80ad29d2aa8cf4.xll windows:1 windows x86 arch:x86
2dc2c8d67def025c88491b68a74c96ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetConsoleNumberOfCommandsA
CancelWaitableTimer
GetCurrencyFormatA
SetConsoleFont
WriteProfileSectionW
GlobalLock
VerLanguageNameA
GetPrivateProfileStructW
GetBinaryTypeW
WriteConsoleInputW
GetSystemDefaultLCID
OpenEventW
EnumResourceNamesA
SetTimeZoneInformation
LoadLibraryA
CreateJobObjectW
GlobalCompact
SetVolumeLabelW
SetLocaleInfoW
OpenJobObjectW
WritePrivateProfileStringW
_lread
GetTimeFormatW
DebugBreak
CreateRemoteThread
IsBadWritePtr
lstrcatA
GetNamedPipeHandleStateW
ReadConsoleOutputA
OpenFileMappingA
GetLongPathNameA
GetTapeParameters
IsValidCodePage
FlushFileBuffers
SetConsoleTextAttribute
IsBadStringPtrW
LocalSize
_lopen
GlobalMemoryStatus
SetVolumeLabelA
ExpungeConsoleCommandHistoryW
LCMapStringW
CreateDirectoryA
GetCommandLineA
BuildCommDCBA
ConsoleMenuControl
LocalFree
FreeResource
RtlFillMemory
CreateFileA
SetWaitableTimer
LocalHandle
MoveFileExA
CompareStringA
SleepEx
FindResourceW
Thread32Next
CreateSemaphoreA
VerLanguageNameW
EnumResourceTypesW
Heap32First
SetLocalTime
CreateNamedPipeA
CreateNamedPipeW
FlushConsoleInputBuffer
SetConsolePalette
SetConsoleCursor
GetNumberFormatA
FatalExit
GetNumberOfConsoleFonts
FindAtomW
GetDiskFreeSpaceExW
OpenMutexA
GetFileType
SetLastConsoleEventActive
InterlockedExchangeAdd
QueryPerformanceCounter
VirtualAllocEx
MoveFileA
EndUpdateResourceA
UnhandledExceptionFilter
WriteConsoleOutputCharacterW
GetModuleHandleA
GetShortPathNameA
GetConsoleWindow
HeapAlloc
InitializeCriticalSectionAndSpinCount
SetConsoleTitleW
GetLocalTime
GetProcAddress
SetCommConfig
GetFileAttributesA
RemoveDirectoryW
WaitForSingleObject
GetSystemInfo
SetCommState
SetFileAttributesW
LCMapStringA
lstrcmpiA
DeleteAtom
GetProfileSectionA
VirtualQueryEx
LoadModule
AddConsoleAliasW
GetConsoleAliasExesLengthW
DisableThreadLibraryCalls
GetFileAttributesExA
GetProcessHeap
CreateSemaphoreW
GetWindowsDirectoryA
SetVDMCurrentDirectories
AssignProcessToJobObject
GetTempFileNameW
GetLocaleInfoA
EscapeCommFunction
GetDiskFreeSpaceW
AddAtomA
_lclose
FindAtomA
CreateFileW
VDMOperationStarted
GetConsoleAliasW
GetSystemPowerStatus
DefineDosDeviceA
WriteConsoleInputVDMW
LoadLibraryExA
GetStartupInfoW
GetConsoleAliasExesLengthA
SystemTimeToTzSpecificLocalTime
CreateWaitableTimerW
LoadLibraryW
SetUnhandledExceptionFilter
HeapFree
SetCriticalSectionSpinCount
ReadConsoleOutputW
ReadConsoleA
WritePrivateProfileStructA
DeleteCriticalSection
FoldStringA
EnumSystemCodePagesA
GetLocaleInfoW
GetConsoleCP
TlsSetValue
GetStdHandle
GetCompressedFileSizeA
SetLocaleInfoA
Module32Next
FindResourceExW
ConvertDefaultLocale
GetConsoleCommandHistoryLengthA
ResumeThread
FindClose
EnumTimeFormatsW
GetUserDefaultLangID
OpenSemaphoreW
LocalUnlock
GetCurrentThread
QueryInformationJobObject
ReadProcessMemory
lstrcmpA
SetConsoleCtrlHandler
SetStdHandle
WaitForMultipleObjects
ReadConsoleW
HeapUnlock
IsBadReadPtr
HeapCreate
GetProcessAffinityMask
OpenEventA
RaiseException
SystemTimeToFileTime
_llseek
GetCommMask
GlobalAddAtomA
GetThreadContext
SetProcessPriorityBoost
Process32Next
GetAtomNameA
LoadLibraryExW
ShowConsoleCursor
SetCommTimeouts
IsProcessorFeaturePresent
EraseTape
SetProcessAffinityMask
WriteConsoleOutputA
HeapValidate
SetSystemTimeAdjustment
CallNamedPipeW
GetOverlappedResult
GetCurrentDirectoryW
VirtualUnlock
CreateFiber
GetConsoleAliasesLengthW
CreateMutexW
GetSystemDefaultLangID
GetCommandLineW
AllocConsole
lstrcatW
HeapWalk
WritePrivateProfileStructW
ReadConsoleOutputCharacterW
GetPrivateProfileStructA
CreateThread
EnumResourceNamesW
MultiByteToWideChar
ScrollConsoleScreenBufferA
SetNamedPipeHandleState
SetThreadAffinityMask
EnumTimeFormatsA
VirtualQuery
OpenJobObjectA
HeapReAlloc
GetPriorityClass
AddAtomW
GetConsoleKeyboardLayoutNameA
GetVersionExW
DeleteFiber
SetConsoleTitleA
GetFullPathNameW
FindResourceExA
Heap32Next
WaitNamedPipeA
SetInformationJobObject
GetConsoleMode
WriteTapemark
OutputDebugStringA
FindNextFileW
GlobalAddAtomW
WriteConsoleInputVDMA
FreeEnvironmentStringsW
ClearCommBreak
SignalObjectAndWait
GetProcessVersion
InterlockedCompareExchange
GetProfileIntA
TlsGetValue
GetFileInformationByHandle
CreateConsoleScreenBuffer
GetVersion
GlobalUnfix
ReadFileEx
Heap32ListNext
GetFileAttributesExW
ReadFile
GetProfileIntW
IsDBCSLeadByteEx
SetConsoleNumberOfCommandsW
GetPrivateProfileStringA
EndUpdateResourceW
GetThreadSelectorEntry
MapViewOfFileEx
FindResourceA
GetCommConfig
OpenWaitableTimerW
InitializeCriticalSection
GetConsoleCommandHistoryW
GetCPInfo
GetStringTypeExA
GetTickCount
PurgeComm
GetConsoleCommandHistoryLengthW
GetCurrentProcessId
GetConsoleCursorInfo
GetAtomNameW
TransactNamedPipe
GetConsoleKeyboardLayoutNameW
GetConsoleAliasesLengthA
CreateMutexA
PeekConsoleInputA
GetProcessHeaps
GetEnvironmentStringsA
GetNumberFormatW
InterlockedExchange
EnumSystemLocalesW
GetNumberOfConsoleMouseButtons
FoldStringW
WriteFileGather
ExitProcess
GetProcessShutdownParameters
GetConsoleAliasA
EnumDateFormatsW
GetPrivateProfileSectionNamesA
RtlZeroMemory
FreeLibraryAndExitThread
EnumSystemLocalesA
GetPrivateProfileIntW
DeviceIoControl
PrepareTape
GetVDMCurrentDirectories
InterlockedIncrement
OpenFile
CreateProcessW
VirtualProtect
TryEnterCriticalSection
GetOEMCP
GetPrivateProfileIntA
GetConsoleTitleW
WritePrivateProfileStringA
ReadConsoleInputExA
GetConsoleFontInfo
ReleaseSemaphore
ConnectNamedPipe
_hread
Beep
BackupRead
GetShortPathNameW
QueueUserAPC
CreateDirectoryW
WaitForSingleObjectEx
GlobalFlags
GetConsoleInputWaitHandle
RegisterConsoleVDM
lstrcmpiW
CopyFileW
CreateEventA
ConvertThreadToFiber
LeaveCriticalSection
GlobalDeleteAtom
GetWindowsDirectoryW
GetLongPathNameW
lstrlenW
GetModuleHandleW
SetConsoleCursorInfo
SetFileApisToOEM
SetThreadContext
GetComputerNameW
CopyFileA
DuplicateConsoleHandle
WriteProcessMemory
InitAtomTable
GetDefaultCommConfigA
GetCommTimeouts
CreateMailslotW
GetTempPathA
LoadResource
CreateEventW
InterlockedDecrement
SetHandleCount
GetModuleFileNameA
EnumCalendarInfoExA
EnumSystemCodePagesW
HeapLock
FileTimeToLocalFileTime
GetProcessPriorityBoost
RequestWakeupLatency
SetProcessShutdownParameters
ReleaseMutex
GetSystemTime
FreeLibrary
SetLastError
IsDBCSLeadByte
GetPrivateProfileStringW
CloseProfileUserMapping
SetEvent
GetThreadPriorityBoost
RemoveDirectoryA
GetTempPathW
OpenWaitableTimerA
GetCurrentDirectoryA
DisconnectNamedPipe
UpdateResourceW
lstrcmpW
SetConsoleDisplayMode
GetDateFormatA
GetCompressedFileSizeW
HeapSize
MoveFileWithProgressA
DebugActiveProcess
GetConsoleInputExeNameW
CompareFileTime
FillConsoleOutputCharacterA
GlobalReAlloc
lstrcpyW
PeekNamedPipe
lstrcpyA
GlobalGetAtomNameW
DefineDosDeviceW
GetDefaultCommConfigW
SetThreadExecutionState
SwitchToThread
ClearCommError
FreeConsole
Module32First
VirtualAlloc
TlsAlloc
FatalAppExitW
SizeofResource
GetSystemTimeAsFileTime
GetExitCodeProcess
GetEnvironmentVariableW
ReadConsoleInputA
ExpandEnvironmentStringsA
lstrcpynW
UnmapViewOfFile
SetConsoleCP
SetEnvironmentVariableA
FillConsoleOutputCharacterW
GetProcessTimes
ExitThread
SetComputerNameW
GetCommState
GetUserDefaultLCID
GlobalFindAtomW
CreateIoCompletionPort
MulDiv
WriteFile
SetCurrentDirectoryW
GetTimeZoneInformation
SetTapePosition
LocalFlags
GetFileTime
LocalLock
Heap32ListFirst
IsBadHugeReadPtr
Process32First
SetCommBreak
OpenSemaphoreA
DuplicateHandle
WaitForDebugEvent
FileTimeToSystemTime
lstrlenA
GlobalFix
GetConsoleAliasExesW
AreFileApisANSI
SetCommMask
SetEnvironmentVariableW
SetErrorMode
FlushInstructionCache
FillConsoleOutputAttribute
SetProcessWorkingSetSize
FindFirstChangeNotificationA
BeginUpdateResourceA
GlobalGetAtomNameA
GetConsoleAliasExesA
SetPriorityClass
lstrcpynA
GetConsoleDisplayMode
GetConsoleCommandHistoryA
CallNamedPipeA
OpenProcess
SetCurrentDirectoryA
SetConsoleActiveScreenBuffer
GetConsoleTitleA
ResetEvent
HeapSummary
GetLastError
CreateMailslotA
WaitNamedPipeW
QueryPerformanceFrequency
TlsFree
GetEnvironmentVariableA
GetVolumeInformationA
WriteProfileStringA
OpenProfileUserMapping
TerminateProcess
GetStringTypeExW
_lwrite
GetFileAttributesW
GetPrivateProfileSectionNamesW
CreateHardLinkW
InvalidateConsoleDIBits
EnumDateFormatsExA
QueryDosDeviceA
RegisterWowBaseHandlers
ExpandEnvironmentStringsW
CommConfigDialogA
OpenFileMappingW
GetEnvironmentStringsW
SetFileApisToANSI
GetMailslotInfo
GetTimeFormatA
GetThreadTimes
BuildCommDCBW
GlobalUnlock
CompareStringW
WriteConsoleW
GetSystemTimeAdjustment
ReadConsoleInputExW
TerminateThread
VirtualFree
CreateTapePartition
MapViewOfFile
UnlockFileEx
GetStringTypeA
DosDateTimeToFileTime
CreatePipe
CopyFileExW
FreeEnvironmentStringsA
Toolhelp32ReadProcessMemory
ReadFileScatter
_hwrite
IsBadStringPtrA
MoveFileW
CmdBatNotification
GetThreadLocale
SearchPathA
FormatMessageA
SetConsoleOutputCP
DeleteFileW
CopyFileExA
comdlg32
FindTextW
ChooseColorW
FindTextA
GetSaveFileNameA
ReplaceTextW
PrintDlgA
GetFileTitleW
GetOpenFileNameA
ChooseFontW
LoadAlterBitmap
ReplaceTextA
GetSaveFileNameW
ChooseFontA
WantArrows
ChooseColorA
GetFileTitleA
GetOpenFileNameW
PrintDlgExA
PageSetupDlgW
CommDlgExtendedError
PrintDlgW
Ssync_ANSI_UNICODE_Struct_For_WOW
PageSetupDlgA
dwLBSubclass
dwOKSubclass
PrintDlgExW
Exports
Exports
Sections
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 66B
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ