skarsnik
Static task
static1
Behavioral task
behavioral1
Sample
bfb2e93107e26a0e5a03ce0cd73209d0a2c7014075f3397a56955e4415c5f6b4.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bfb2e93107e26a0e5a03ce0cd73209d0a2c7014075f3397a56955e4415c5f6b4.dll
Resource
win10v2004-20240611-en
General
-
Target
bfb2e93107e26a0e5a03ce0cd73209d0a2c7014075f3397a56955e4415c5f6b4
-
Size
1.3MB
-
MD5
f1caf4ad83de93254bf0b8956be63654
-
SHA1
7714d9fbb76db9f4e2d31910a930b5decc04d194
-
SHA256
bfb2e93107e26a0e5a03ce0cd73209d0a2c7014075f3397a56955e4415c5f6b4
-
SHA512
c476dbbcac9a7548cbea8f5bff65aadbf50f42ab346d0e203588ee847065478013ae291c321ec3b18a28100358a3c21fb0f0d47cca065d56d07a32c185be9264
-
SSDEEP
24576:NzgWbbIQpdAYo+XU5Tc8Qa7FGdOZHGTtwtQ/L:NEWbbBpdFXU5iaEOZHGTH/L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bfb2e93107e26a0e5a03ce0cd73209d0a2c7014075f3397a56955e4415c5f6b4
Files
-
bfb2e93107e26a0e5a03ce0cd73209d0a2c7014075f3397a56955e4415c5f6b4.dll windows:5 windows x64 arch:x64
3bf0ef2cf2b33d9d76d341815a9dd440
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
WSASetLastError
ntohl
ntohs
htonl
htons
getsockopt
connect
freeaddrinfo
getaddrinfo
WSAGetLastError
setsockopt
WSASocketW
WSASend
WSARecv
select
ioctlsocket
closesocket
WSACleanup
WSAStartup
kernel32
GetTimeZoneInformation
InitializeSListHead
LoadLibraryW
Sleep
FreeLibraryAndExitThread
GetProcAddress
GetCurrentThreadId
CreateThread
GetModuleHandleExW
GetModuleFileNameW
GetNativeSystemInfo
IsWow64Process
GetLastError
CloseHandle
GetCurrentProcess
GetModuleHandleW
GetVersionExW
GetExitCodeThread
WaitForSingleObject
TerminateThread
OpenEventW
CreateEventW
SetEvent
ResetEvent
FreeLibrary
GetSystemTimeAsFileTime
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
SetEndOfFile
LeaveCriticalSection
TlsAlloc
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
QueueUserAPC
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
SetLastError
TlsGetValue
TlsSetValue
TlsFree
GetThreadContext
HeapReAlloc
SetThreadContext
HeapAlloc
HeapFree
Thread32First
HeapDestroy
Thread32Next
OpenThread
VirtualProtect
CreateToolhelp32Snapshot
SuspendThread
ResumeThread
RaiseException
DecodePointer
OpenMutexW
CreateMutexW
ReleaseMutex
VirtualQuery
VirtualFree
GetSystemInfo
GetModuleHandleA
GetThreadTimes
OutputDebugStringW
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileW
SetEnvironmentVariableA
FormatMessageA
OpenEventA
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
IsProcessorFeaturePresent
GetCommandLineA
FileTimeToSystemTime
GetCPInfo
ExitThread
LoadLibraryExW
IsDebuggerPresent
ExitProcess
AreFileApisANSI
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
ReadFile
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetProcessHeap
GetCurrentThread
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
user32
SetActiveWindow
EnumWindows
GetWindowTextW
GetClassNameW
SendMessageTimeoutW
BringWindowToTop
advapi32
RegEnumValueW
RegCloseKey
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
Exports
Exports
Sections
.text Size: 856KB - Virtual size: 856KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ