Behavioral task
behavioral1
Sample
bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8.dll
Resource
win7-20240221-en
General
-
Target
bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8
-
Size
38KB
-
MD5
5920faa17dcac69cd5ab8d8fd14fdf43
-
SHA1
0fa4da2dc4a0c2a96511bbd2c3d5f6e26940bdac
-
SHA256
bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8
-
SHA512
8bdabe217ef77c62c9178eb2837b6aa30b9b6b289069cd7c392a8d0bf9de40259834b853c9e5b81ca176803307c25fce931261a4f118c3af7c9d608658144faa
-
SSDEEP
768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7fIXU76m2sjhVV:WD8w22laSR0V+3CJrVyXczJj
Malware Config
Signatures
-
Ramnit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8
Files
-
bd5982f797b9d1f6e932c7a8a2705ae1a38b5ff83e7670e12809a6ee74b0c9b8.dll .vbs windows:4 windows x86 arch:x86 polyglot
2e9f172ab7f5de80401af8d766cf3803
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileSize
GetLastError
GetLocaleInfoA
GetLogicalDriveStringsA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
CreateProcessA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
ReadFile
ReleaseMutex
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFilePointer
SetThreadPriority
Sleep
TryEnterCriticalSection
UnmapViewOfFile
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateDirectoryA
GlobalReAlloc
CloseHandle
ws2_32
htons
inet_addr
ioctlsocket
listen
getsockname
select
send
connect
getpeername
recv
gethostbyname
bind
accept
__WSAFDIsSet
WSAStartup
WSAGetLastError
WSACleanup
socket
closesocket
user32
wsprintfA
MessageBoxA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
shell32
ShellExecuteA
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ