NSModule
Static task
static1
Behavioral task
behavioral1
Sample
7de873908905593d2fbe9336fbfbd491b57a74e83caa0b78422d774e1331d8f0.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7de873908905593d2fbe9336fbfbd491b57a74e83caa0b78422d774e1331d8f0.dll
Resource
win10v2004-20240426-en
General
-
Target
7de873908905593d2fbe9336fbfbd491b57a74e83caa0b78422d774e1331d8f0
-
Size
259KB
-
MD5
40cd988b9faff8331aab83e7d81b5b54
-
SHA1
b4df763f868e54e8e8f78c5a907d97eaed292df1
-
SHA256
7de873908905593d2fbe9336fbfbd491b57a74e83caa0b78422d774e1331d8f0
-
SHA512
b6771acaa875ef953954eb469ba7466bd7edae61021a955b88f8eba8fe93aa8d1b2a3073c7ff7fe9e1bbc31b0f1ac40db997038f3de99061c30a67a9c42d0500
-
SSDEEP
3072:y8NMgaEv8I+/+PDhW/BfH5a9kAhi0000ZVYCCCCCCCCCCCCCCCCCCCCCCCCCCCCo:yS8Ii+c/xH5aYwcxFM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7de873908905593d2fbe9336fbfbd491b57a74e83caa0b78422d774e1331d8f0
Files
-
7de873908905593d2fbe9336fbfbd491b57a74e83caa0b78422d774e1331d8f0.dll windows:5 windows x86 arch:x86
fe7011c074416bfc8f47f24077c95da1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xul
NS_GetServiceManager
NS_GetComponentManager
NS_DebugBreak
NS_CStringGetMutableData
NS_StringGetMutableData
NS_StringSetDataRange
NS_CStringToUTF16
NS_StringGetData
NS_StringCopy
NS_UTF16ToCString
NS_StringContainerInit2
NS_StringContainerInit
NS_NewNativeLocalFile
NS_StringContainerFinish
NS_CStringCopy
NS_CStringGetData
NS_CStringContainerInit2
NS_CStringSetData
NS_CStringSetDataRange
NS_CStringContainerFinish
NS_CStringContainerInit
mozalloc
moz_xmalloc
moz_xrealloc
?mozalloc_abort@@YAXQBD@Z
moz_free
nss3
PR_ImplodeTime
kernel32
HeapAlloc
RtlUnwind
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
LoadLibraryExW
OutputDebugStringW
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
Sleep
GetEnvironmentVariableW
FreeLibrary
CreateProcessW
GetSystemDirectoryW
LoadLibraryW
GetVersionExW
GetModuleFileNameW
GetLongPathNameW
GetProcAddress
CloseHandle
FileTimeToSystemTime
GetCurrentProcess
TerminateProcess
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
FlushFileBuffers
WriteConsoleW
GetStringTypeW
HeapSize
SetStdHandle
GetCurrentThreadId
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
EncodePointer
DecodePointer
GetCommandLineA
CreateFileW
GetLastError
GetStdHandle
WriteFile
IsProcessorFeaturePresent
IsDebuggerPresent
SetLastError
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
user32
GetSysColor
SystemParametersInfoW
SetSysColors
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
shlwapi
PathAppendW
SHDeleteKeyW
Exports
Exports
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 186KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ