Behavioral task
behavioral1
Sample
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c.dll
Resource
win7-20240221-en
General
-
Target
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c
-
Size
68KB
-
MD5
6ac6ec6d1181f9c5d1fd5918672c908a
-
SHA1
5b4de7de19c9c2ecaa64ec19f6a8addb7e1ffd14
-
SHA256
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c
-
SHA512
1895855bce51d9cc595f8a337a95c6bc3271bc9d55267ad9122b5ce9515bb93313ff42d1cbd7a979c3c8552becdd73d2c617f1a4d021a1f73b3899b44a8943ac
-
SSDEEP
1536:MLNd/Pk7btaoX7DypKr0wNkYIUSS9eyBhs0iZs3+:GNhY5aora80mkYI7ysXs3
Malware Config
Signatures
-
Ramnit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c
Files
-
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c.dll .vbs windows:4 windows x86 arch:x86 polyglot
62a7616cac5efe94334afe90464544ad
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
GetFileSize
GetFileTime
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDriveStringsA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalReAlloc
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
GetCurrentProcess
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MoveFileA
MultiByteToWideChar
OpenFileMappingA
OpenMutexA
ReadFile
ReleaseMutex
RemoveDirectoryA
ResumeThread
RtlMoveMemory
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetThreadPriority
Sleep
TryEnterCriticalSection
UnmapViewOfFile
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
ExitProcess
EnterCriticalSection
DeleteCriticalSection
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateDirectoryA
CopyFileA
CompareStringA
InitializeCriticalSection
CloseHandle
ws2_32
recv
listen
ioctlsocket
inet_addr
select
getsockname
send
socket
getpeername
gethostbyname
connect
closesocket
bind
accept
__WSAFDIsSet
WSAStartup
WSAGetLastError
WSACleanup
htons
user32
GetDC
ExitWindowsEx
CharUpperBuffW
MessageBoxA
GetDesktopWindow
wsprintfA
advapi32
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
LookupPrivilegeValueA
shell32
ShellExecuteA
gdi32
CreateCompatibleDC
DeleteDC
DeleteObject
GdiFlush
GetDeviceCaps
SelectObject
SetStretchBltMode
StretchBlt
CreateDIBSection
ole32
CreateStreamOnHGlobal
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ