Static task
static1
Behavioral task
behavioral1
Sample
c56fda375aca806b53665141bd8dc1300bcf0801c87306a3deea5f9b6a29655b.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c56fda375aca806b53665141bd8dc1300bcf0801c87306a3deea5f9b6a29655b.dll
Resource
win10v2004-20240426-en
Errors
General
-
Target
c56fda375aca806b53665141bd8dc1300bcf0801c87306a3deea5f9b6a29655b
-
Size
95KB
-
MD5
b0c86a1a9ae3c66d031e6f64025060d9
-
SHA1
12fdf9a9b9933b095e8a68766c467d0029b40b47
-
SHA256
c56fda375aca806b53665141bd8dc1300bcf0801c87306a3deea5f9b6a29655b
-
SHA512
3e55bd09853fb6f4f1e737a4f9f9d3a71ee725b92af3aa1dceb9bb3bac40bc635159651d72e65111658457e7a4af039c80b9acb6268ef7836946a295019c129d
-
SSDEEP
1536:jxHbevgzvQ7Jz6Rx9vqnMvJLdS0KSJEF8m7vQzd2zTr1E5+ALuHnBqVxcGpFMrE:FHbWh7JzM9BS0NEBvIwzTy5ZuHBqVxFf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c56fda375aca806b53665141bd8dc1300bcf0801c87306a3deea5f9b6a29655b
Files
-
c56fda375aca806b53665141bd8dc1300bcf0801c87306a3deea5f9b6a29655b.dll windows:5 windows x86 arch:x86
beae3c8acb0a92a279ef9a1fd4f7f80b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
VirtualFree
Sleep
lstrlenA
VirtualAlloc
GetCurrentProcessId
CreateThread
CloseHandle
GetModuleFileNameA
GetLastError
ReadFile
GetFileSize
CreateFileA
CallNamedPipeA
CreateMutexA
GetVersion
GetCurrentProcess
GetSystemDirectoryW
WaitForSingleObject
CreateFileW
SetFilePointer
WriteFile
SetEndOfFile
GetTempPathW
GetTempFileNameW
lstrcatA
lstrcpyA
OpenProcess
GetProcAddress
GetModuleHandleA
GetVolumeInformationA
GetWindowsDirectoryA
user32
wsprintfA
wsprintfW
ExitWindowsEx
shlwapi
StrChrA
StrCatW
StrCpyW
PathCombineW
ntdll
ZwClose
memcpy
ZwReadFile
memset
_chkstk
RtlAdjustPrivilege
ZwWriteFile
ZwOpenFile
ZwDeviceIoControlFile
ZwCreateFile
ZwOpenProcessToken
ZwOpenProcess
ZwQueryInformationToken
RtlInitUnicodeString
advapi32
RegCreateKeyA
OpenProcessToken
RegCloseKey
RegOpenKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetTokenInformation
shell32
ShellExecuteExW
SHCreateItemFromParsingName
ole32
CoCreateInstance
CoGetObject
CoInitialize
CoUninitialize
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ