pluginMain
Static task
static1
Behavioral task
behavioral1
Sample
4d9a8f220f77be6e96eaa359cf292bc946cc41a8d76b602952fae4ee75d2558f.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4d9a8f220f77be6e96eaa359cf292bc946cc41a8d76b602952fae4ee75d2558f.dll
Resource
win10v2004-20240412-en
General
-
Target
4d9a8f220f77be6e96eaa359cf292bc946cc41a8d76b602952fae4ee75d2558f
-
Size
59KB
-
MD5
f29374f65c6b33297ef01bad9c9e33c6
-
SHA1
ea36d02d3d1e7d2b56c72d45d8cdd4031640b9b8
-
SHA256
4d9a8f220f77be6e96eaa359cf292bc946cc41a8d76b602952fae4ee75d2558f
-
SHA512
d5d6928321cc8ea37888f078f07c3eb20e610599f267ea4bd91bcea1533ae482933ce25fbbab8b6cfdd4973475826e31f7dff7a9e547c11eba4b81b43f5cf693
-
SSDEEP
768:BXWUQH+favYjvx+KiRxjvXfysIMkX4F9fYO8EAJLp7004oz1aqjCIV34gGAFnZI:BXZc+CkaXJIx4F9hBANpP1aqjCIF2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d9a8f220f77be6e96eaa359cf292bc946cc41a8d76b602952fae4ee75d2558f
Files
-
4d9a8f220f77be6e96eaa359cf292bc946cc41a8d76b602952fae4ee75d2558f.dll windows:5 windows x64 arch:x64
caa86c0f718801d75beea84b47e76744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
Sleep
LoadLibraryA
GetProcAddress
GetLastError
FormatMessageA
OutputDebugStringA
LocalFree
FreeLibrary
DisableThreadLibraryCalls
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
user32
MessageBoxA
advapi32
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclA
IsValidAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
libmmd
ceilf
powf
__isinff
log10f
msvcr100
memcpy
_onexit
_lock
__dllonexit
_unlock
memmove
__clean_type_info_names_internal
_putenv_s
sprintf
getenv
free
malloc
wcstombs
wcschr
mbstowcs
_vsnprintf
_ftime64
isspace
strstr
memset
_close
_read
_open
_malloc_crt
_initterm
_initterm_e
_encoded_null
_amsg_exit
__C_specific_handler
__CppXcptFilter
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 820B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ