Static task
static1
Behavioral task
behavioral1
Sample
36b0542d38b57323e8e5b5a076889b6069bdc42c2b4d5b0d39e05b91b7766647.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
36b0542d38b57323e8e5b5a076889b6069bdc42c2b4d5b0d39e05b91b7766647.dll
Resource
win10v2004-20240426-en
General
-
Target
36b0542d38b57323e8e5b5a076889b6069bdc42c2b4d5b0d39e05b91b7766647
-
Size
1.0MB
-
MD5
1b49710aea6139fe15529e68fb2991b6
-
SHA1
cc99e1cf44d38aa76b9b766cd041766eace4a621
-
SHA256
36b0542d38b57323e8e5b5a076889b6069bdc42c2b4d5b0d39e05b91b7766647
-
SHA512
56b06bccc72e981a7e245db59b581e854d56fc2a844fe4d1740250c16d6b0cff404768fac451fdac59bedbff7b138dde87e0c46778d6afc90c1a0e82d601d80e
-
SSDEEP
12288:1uncHOKwoeC32zwamB1NqfInq8kWrDazfrT3/9V3TgZeCn:1KLKwoek2saG3Bq8LDaDPlV3T+n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36b0542d38b57323e8e5b5a076889b6069bdc42c2b4d5b0d39e05b91b7766647
Files
-
36b0542d38b57323e8e5b5a076889b6069bdc42c2b4d5b0d39e05b91b7766647.dll windows:6 windows x64 arch:x64
2ab4597b47ff30e0da86243d46c1373e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
bcryptprimitives
ProcessPrng
kernel32
ConnectNamedPipe
CreateNamedPipeW
ReadFile
WriteFile
GetCurrentProcess
UnmapViewOfFile
DisconnectNamedPipe
VirtualQuery
MapViewOfFile
CreateFileMappingW
CreateFileW
FormatMessageW
GetCurrentThreadId
GetSystemTimeAsFileTime
WaitForSingleObject
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
GetLastError
UnhandledExceptionFilter
HeapFree
GetSystemInfo
HeapAlloc
CreateIoCompletionPort
CancelIoEx
GetOverlappedResult
PostQueuedCompletionStatus
VirtualProtect
VirtualFree
GetProcessHeap
GetQueuedCompletionStatusEx
FreeLibrary
GetProcAddress
VirtualAlloc
Sleep
GetModuleHandleA
lstrlenW
SetUnhandledExceptionFilter
GetCurrentThread
LocalFree
SetThreadStackGuarantee
SwitchToThread
QueryPerformanceCounter
AllocConsole
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
CloseHandle
SetFileInformationByHandle
Module32FirstW
GetStdHandle
GetCurrentProcessId
Process32NextW
QueryPerformanceFrequency
Process32FirstW
HeapReAlloc
ReleaseMutex
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
CreateToolhelp32Snapshot
LoadLibraryExA
GetConsoleMode
GetNativeSystemInfo
GetModuleHandleW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
IsProcessorFeaturePresent
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
ntdll
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtCancelIoFileEx
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
vcruntime140
memset
memcpy
__CxxFrameHandler3
memcmp
__std_type_info_destroy_list
memmove
__C_specific_handler
_CxxThrowException
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-stdio-l1-1-0
fgetc
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_execute_onexit_table
_cexit
_initterm
api-ms-win-crt-heap-l1-1-0
free
Sections
.text Size: 635KB - Virtual size: 635KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ