Static task
static1
Behavioral task
behavioral1
Sample
0179df16853e6dfc3d1c67e5b7b466ce.dll
Resource
win7-20240508-en
General
-
Target
0179df16853e6dfc3d1c67e5b7b466ce.bin
-
Size
56KB
-
MD5
0179df16853e6dfc3d1c67e5b7b466ce
-
SHA1
81944e1037e6416eef7a4b291acc9c12a95173af
-
SHA256
d41fbce8b3fdb4bc666d937ff56600b10adf4dea522c606421d47e911c0b0c70
-
SHA512
bef188fd38c1b29159580b2c511412b8749e39ae9a506cbb3275e7605541ba6fa26279fef19ff3c597b983ccb9c031b976a8d186a0f1c9867b24b0d0ac0b2feb
-
SSDEEP
768:noUt7LwLVgHJHs8qeQHw+NX+JzwsA92N0+cmfk8i:oUxwLVuts8qeQpy8Oi+cmg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0179df16853e6dfc3d1c67e5b7b466ce.bin
Files
-
0179df16853e6dfc3d1c67e5b7b466ce.bin.dll windows:4 windows x86 arch:x86
5ecb231c33b4080a70ba4db4e4266bdb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord825
ord389
ord823
ord5207
ord5356
ord540
ord2915
ord800
ord1988
ord690
msvcrt
_adjust_fdiv
malloc
_initterm
free
sprintf
atoi
tolower
strcmp
strcpy
strcat
strlen
__CxxFrameHandler
kernel32
FindResourceA
SizeofResource
LoadResource
GetCurrentProcess
WriteFile
GetSystemDirectoryA
CreateThread
SetFilePointer
DeleteFileA
LockResource
CreateFileA
GetFileSize
WaitForSingleObject
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateProcessA
CreateToolhelp32Snapshot
Process32First
Process32Next
Sleep
LoadLibraryA
CloseHandle
ReadFile
user32
GetWindowThreadProcessId
FindWindowA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
shell32
SHGetFolderPathA
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntry
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ