ezswo
Static task
static1
Behavioral task
behavioral1
Sample
1824f708d77c62ad41e15ea55ebb66e6c6aa9f34ef435e9002fe322823d32f99.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1824f708d77c62ad41e15ea55ebb66e6c6aa9f34ef435e9002fe322823d32f99.dll
Resource
win10v2004-20240412-en
General
-
Target
1824f708d77c62ad41e15ea55ebb66e6c6aa9f34ef435e9002fe322823d32f99
-
Size
352KB
-
MD5
fc66bd711bdbd754b783d5c8d00ca7ad
-
SHA1
ff85be493e922bfab9bfbbff56e0c0cc2061d51b
-
SHA256
1824f708d77c62ad41e15ea55ebb66e6c6aa9f34ef435e9002fe322823d32f99
-
SHA512
a981894dcea0250267bff27de54f1916ac189087849f243e40958495a18fcaa563d4fee56f2e60a7dacb184b01702ed13ced2ad41c086fcc312ff348415aadc7
-
SSDEEP
6144:Di1vizpSw8DT+vC7cYaVgE9hUQReUkzXAR96F/2sS50yqOvXhoxU:aqzp9AjICE9h5TkLzFbC9vX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1824f708d77c62ad41e15ea55ebb66e6c6aa9f34ef435e9002fe322823d32f99
Files
-
1824f708d77c62ad41e15ea55ebb66e6c6aa9f34ef435e9002fe322823d32f99.dll windows:4 windows x86 arch:x86
32c5083a6cd24007b8f0c8f99df67b3e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
SHEnumKeyExA
kernel32
Beep
CloseHandle
CompareStringA
OpenEventA
CreateNamedPipeA
DeleteAtom
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
GetConsoleCP
GetExitCodeProcess
GetMailslotInfo
GetModuleFileNameA
GetModuleHandleA
GetNamedPipeInfo
GetProcessHeap
GetStdHandle
GetCurrentThreadId
GetThreadLocale
GetUserDefaultLCID
GlobalAlloc
IsSystemResumeAutomatic
IsValidCodePage
IsValidLocale
ReleaseMutex
ResetEvent
SetFilePointer
GetStartupInfoA
DeleteFileA
ReadFile
CreateFileA
ExitProcess
GetComputerNameA
GetBinaryTypeA
GetFileType
lstrcmpA
lstrlenW
SetCurrentDirectoryA
FlushViewOfFile
GetDriveTypeW
GetDriveTypeA
GetWindowsDirectoryW
GetCurrentDirectoryA
GetSystemDirectoryW
GetCurrentDirectoryW
GetFileAttributesA
GetFileAttributesW
lstrcmpW
WriteFile
user32
ReleaseDC
advapi32
GetUserNameW
msvcrt
free
malloc
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
winmm
DrvGetModuleHandle
timeEndPeriod
Exports
Exports
Sections
.code Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zthk Size: 4KB - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ