fmed_getmod
Static task
static1
Behavioral task
behavioral1
Sample
197e722b3ef3b25d08f2a732e009e6e9b3980a09e968c4309b01f6366db39bff.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
197e722b3ef3b25d08f2a732e009e6e9b3980a09e968c4309b01f6366db39bff.dll
Resource
win10v2004-20240426-en
General
-
Target
197e722b3ef3b25d08f2a732e009e6e9b3980a09e968c4309b01f6366db39bff
-
Size
53KB
-
MD5
b3ce464fc34c9abd25d107ae7b5bad1d
-
SHA1
d0be9340994e2886665ec77ae672142f660828e7
-
SHA256
197e722b3ef3b25d08f2a732e009e6e9b3980a09e968c4309b01f6366db39bff
-
SHA512
456f14abc7f4b3a0abbbd6d89a661c56bf9a1ace3943c02a72af66ebf0ee3b66d7f84c320b5a4e5039a4497cea70fac5a2eda19ce865dc64052b2d9eb4ee7868
-
SSDEEP
1536:qmSZAO3CwKjwZ/ZmtZ24N5t8QEFFFzvvKf:qJrSwKjx5W7vvKf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 197e722b3ef3b25d08f2a732e009e6e9b3980a09e968c4309b01f6366db39bff
Files
-
197e722b3ef3b25d08f2a732e009e6e9b3980a09e968c4309b01f6366db39bff.dll windows:4 windows x64 arch:x64
618e13c9b870306b476e01c6c2d46046
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
advapi32
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
kernel32
CancelWaitableTimer
CloseHandle
ConnectNamedPipe
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateSemaphoreW
CreateThread
CreateWaitableTimerW
DeleteCriticalSection
DeleteFileW
DisconnectNamedPipe
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesExW
GetFileAttributesW
GetFileSizeEx
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetNumberOfConsoleInputEvents
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessIoCounters
GetProcessTimes
GetQueuedCompletionStatus
GetSystemTimeAsFileTime
GetThreadTimes
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenSemaphoreW
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputW
ReadFile
RemoveDirectoryW
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetDllDirectoryW
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointerEx
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SwitchToThread
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WriteConsoleW
WriteFile
msvcrt
__dllonexit
__iob_func
_amsg_exit
_exit
_initterm
_lock
_onexit
_snwprintf
_stricmp
_unlock
_wcsicmp
abort
calloc
free
fwprintf
fwrite
malloc
memchr
memcmp
memcpy
memmove
memset
raise
signal
strcpy
strlen
strncmp
vfprintf
wcscpy
wcslen
_timezone
_daylight
_tzset
user32
MessageBoxW
SendMessageTimeoutW
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ