DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
bf4e36bace952318bcf23d4e0e6a8e42761d46d8da22d94b9d0b4d4c481cf4f1.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bf4e36bace952318bcf23d4e0e6a8e42761d46d8da22d94b9d0b4d4c481cf4f1.dll
Resource
win10v2004-20240412-en
General
-
Target
bf4e36bace952318bcf23d4e0e6a8e42761d46d8da22d94b9d0b4d4c481cf4f1
-
Size
1.2MB
-
MD5
09ddfbb954a2c4bfcb155370e3452690
-
SHA1
7b562456d6ecbe7a91e99c4fa4d307fb5d2c1400
-
SHA256
bf4e36bace952318bcf23d4e0e6a8e42761d46d8da22d94b9d0b4d4c481cf4f1
-
SHA512
4006a0d5bc692c54c8602f2663cac5275ef1cd4815deba829035163a76b48f31aa1b5a9b22f948b6f6caeba8cfdf3ccdc02a11d767549d56379eae8f04d3d02e
-
SSDEEP
24576:GBYFiOKLHhmwf4d20O3BE0cIJpirt7o9b8:rFCHhZfW5IE0cIIt7o9b8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf4e36bace952318bcf23d4e0e6a8e42761d46d8da22d94b9d0b4d4c481cf4f1
Files
-
bf4e36bace952318bcf23d4e0e6a8e42761d46d8da22d94b9d0b4d4c481cf4f1.dll windows:4 windows x64 arch:x64
3846278e9797d4fc4d2cadb945cdb018
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
DisableThreadLibraryCalls
GetModuleHandleW
GetTickCount
HeapAlloc
HeapReAlloc
kernelbase
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetModuleHandleA
GetProcAddress
LocalAlloc
LocalFree
MultiByteToWideChar
PathCombineW
PathIsRelativeW
PathIsUNCW
WideCharToMultiByte
ntdll
_vsnprintf
ucrtbase
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
_assert
_close
_errno
_fdopen
_lseek
_open
_read
_setmode
_strdup
_stricmp
_strnicmp
_wfopen
_wgetenv
_wopen
_write
atof
calloc
fclose
fopen
free
fwrite
getenv
log
malloc
memcmp
memcpy
memmove
memset
pow
realloc
strchr
strcmp
strcspn
strerror
strlen
strncmp
strncpy
wcslen
wcsncmp
user32
MessageBoxA
winmm
DefDriverProc
Exports
Exports
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rodata Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 320B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 332KB - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/31 Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/45 Size: 116KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/57 Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/70 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/81 Size: 328KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/92 Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/106 Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ