Static task
static1
Behavioral task
behavioral1
Sample
b898d01fbba9b1bac5804381e853af882e88c7d5dd45ada7fd6627f06e2f5e6e.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b898d01fbba9b1bac5804381e853af882e88c7d5dd45ada7fd6627f06e2f5e6e.dll
Resource
win10v2004-20240508-en
General
-
Target
b898d01fbba9b1bac5804381e853af882e88c7d5dd45ada7fd6627f06e2f5e6e
-
Size
37KB
-
MD5
2d7c69e4a5fc786904f006eba6532c4f
-
SHA1
ebcf66ca25627fd877dbf51281e86cd6b26022c4
-
SHA256
b898d01fbba9b1bac5804381e853af882e88c7d5dd45ada7fd6627f06e2f5e6e
-
SHA512
50ab3be34d688a87304024958259511d5f11282cf60814cfae97183bcdb958b7125e1220fcc8ccb3e6535f0d0b99b5873b545b085753277f74605f197fd2e02e
-
SSDEEP
768:PUOk132B5JfxIIC1huxti7DyvvBEfJqDWOsUYHIr6QtqClIvdYsDODrY2dy:PnZB5BxIIC1huxti7DyvvBEfYStU34Uk
Malware Config
Signatures
-
Detects executables packed with Dotfuscator 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Dotfuscator -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b898d01fbba9b1bac5804381e853af882e88c7d5dd45ada7fd6627f06e2f5e6e
Files
-
b898d01fbba9b1bac5804381e853af882e88c7d5dd45ada7fd6627f06e2f5e6e.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ