Work
Static task
static1
Behavioral task
behavioral1
Sample
f3d388a07bae0113624ea9a902766089ecdbcb0b07d8d59cbe2a31e858359ad1.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3d388a07bae0113624ea9a902766089ecdbcb0b07d8d59cbe2a31e858359ad1.dll
Resource
win10v2004-20240226-en
General
-
Target
f3d388a07bae0113624ea9a902766089ecdbcb0b07d8d59cbe2a31e858359ad1
-
Size
157KB
-
MD5
31722f35668777cc095fb887dcba2a12
-
SHA1
84d669107c74e2dabfdf1df62e6bd52165335272
-
SHA256
f3d388a07bae0113624ea9a902766089ecdbcb0b07d8d59cbe2a31e858359ad1
-
SHA512
bbddffcb17cb42b875598fd429484f06b7b8b55abcd6ecf46643c8d50511b9255d9fddf982e1dfcefb479682fe71060a94c38723a92a37c6549d765f88cc7be0
-
SSDEEP
3072:6qJqhrrFfm97WUp1hmT66Qyfm6aJpKLfpozhbnIVu0I0d:6qJqlpKhmu6QyfvaHKLfpozhbIVu0D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3d388a07bae0113624ea9a902766089ecdbcb0b07d8d59cbe2a31e858359ad1
Files
-
f3d388a07bae0113624ea9a902766089ecdbcb0b07d8d59cbe2a31e858359ad1.dll windows:4 windows x86 arch:x86
04893fe23eb6b82f4ae2f9d640ee4169
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThread
ExpandEnvironmentStringsA
lstrlenW
lstrlenA
OutputDebugStringA
DeleteFileA
GetFileSize
CreateFileA
WaitForSingleObject
ReleaseMutex
CreateMutexA
SetEvent
CreateEventA
GetTickCount
Sleep
GlobalFree
GlobalAlloc
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetACP
CreateToolhelp32Snapshot
Process32First
OpenProcess
Process32Next
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
GetCurrentProcess
CloseHandle
CreateProcessA
GetLocalTime
GetLastError
user32
MessageBoxA
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
UnregisterClassA
GetClassInfoA
DefWindowProcA
PostQuitMessage
DispatchMessageA
PostMessageA
TranslateMessage
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptImportKey
CryptSetHashParam
CryptGetHashParam
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
GetTokenInformation
EqualSid
ConvertSidToStringSidA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
ole32
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
VariantClear
SysAllocStringLen
SysFreeString
msvcp60
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPAD0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Xlen@std@@YAXXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
mfc42
ord924
ord939
ord941
ord2614
ord4278
ord538
ord926
ord860
ord540
ord858
ord537
ord535
ord800
ord2915
ord5572
ord922
msvcrt
_onexit
_strlwr
_stricmp
__CxxFrameHandler
memset
strstr
sprintf
sscanf
strncpy
strlen
memcmp
strcpy
memcpy
memmove
strtol
strncmp
_mbclen
strchr
_mbscmp
fwrite
fread
ftell
fseek
fopen
fclose
fflush
_beginthreadex
_strupr
_mbsicmp
free
malloc
time
rand
_CxxThrowException
srand
strcat
isspace
atoi
fscanf
_beginthread
_except_handler3
?terminate@@YAXXZ
__dllonexit
_vsnprintf
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_itoa
winmm
timeGetTime
wininet
InternetSetOptionA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
HttpQueryInfoA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetCrackUrlA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ