NEP_StartScan
Static task
static1
Behavioral task
behavioral1
Sample
7925c2d630999455db3ae02b8ccc7eea44e91d3f4db80553a3735e2de87311c4.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7925c2d630999455db3ae02b8ccc7eea44e91d3f4db80553a3735e2de87311c4.dll
Resource
win10v2004-20240508-en
General
-
Target
7925c2d630999455db3ae02b8ccc7eea44e91d3f4db80553a3735e2de87311c4
-
Size
8.9MB
-
MD5
34b40b79e5c50d6e0a66cafc6b860dec
-
SHA1
0743d156df502208d3fa05a3e2a08cbb3b7248f3
-
SHA256
7925c2d630999455db3ae02b8ccc7eea44e91d3f4db80553a3735e2de87311c4
-
SHA512
468185ecc8bd4d327396ebb68f56ac2a874a890f9ea77fdcda0b2619bb210c992c70e2131c7510bdf425319dda92f295befa01ff483b658473b5d8adc4862035
-
SSDEEP
196608:ChRspK7vGSKSBUxGnJzQqXUCnUFP5uicDUBILXlIn:CXGSKSBUxGn60XnUFPYXTE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7925c2d630999455db3ae02b8ccc7eea44e91d3f4db80553a3735e2de87311c4
Files
-
7925c2d630999455db3ae02b8ccc7eea44e91d3f4db80553a3735e2de87311c4.dll windows:6 windows x64 arch:x64
b722e0ec193df6b12c8639b6b16438a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGetProvParam
shell32
ord680
ole32
CreateStreamOnHGlobal
oleaut32
SafeArrayGetLBound
ws2_32
closesocket
shlwapi
PathCombineW
wintrust
WinVerifyTrust
ntdll
RtlVirtualUnwind
rpcrt4
RpcServerUnregisterIf
dbghelp
ImageDirectoryEntryToData
mpr
WNetGetProviderNameW
iphlpapi
GetNetworkParams
setupapi
SetupDiGetClassDevsW
bcrypt
BCryptGenRandom
gdiplus
GdipGetImageWidth
gdi32
BitBlt
crypt32
CertGetCertificateContextProperty
psapi
GetModuleFileNameExW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 929KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ndata1 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ndata0 Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.200 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.201 Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ