D:\TEMP\wky_mva-v940_wx6no_en_t0b6zh_1816624139_e\usr\tmp\wky_mva-v940_wx6no_en_t0b6zh_1816624139_e\t0b6zh.pdb
Static task
static1
Behavioral task
behavioral1
Sample
386db235089cbbd5c8a0d978d44d2d968f54be10bcdb4c7addb5b00dfbb57444.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
386db235089cbbd5c8a0d978d44d2d968f54be10bcdb4c7addb5b00dfbb57444.dll
Resource
win10v2004-20240508-en
General
-
Target
386db235089cbbd5c8a0d978d44d2d968f54be10bcdb4c7addb5b00dfbb57444
-
Size
112KB
-
MD5
1588557242a9cba5ad48e58cc8cedea5
-
SHA1
d7270cf8437ccdbba3ab77c7821654c562c9af3b
-
SHA256
386db235089cbbd5c8a0d978d44d2d968f54be10bcdb4c7addb5b00dfbb57444
-
SHA512
aea6a8535675d9b64c9d8ddfe6ebb4a5c05fc992f0d58d16722732bdf55a7598584f6b259ae27ad87988e6fef8e4e3d02e5d1815300af7250822763c771a2ff7
-
SSDEEP
1536:4y7guYRkMrPJTeEYQIEpazoCpXChuKl/h8C2lMbk:4yry9PNeEYQIEA0hTl/hxDg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 386db235089cbbd5c8a0d978d44d2d968f54be10bcdb4c7addb5b00dfbb57444
Files
-
386db235089cbbd5c8a0d978d44d2d968f54be10bcdb4c7addb5b00dfbb57444.dll windows:4 windows x64 arch:x64
8a7f46826a47a7ad13ccfb9dd0ef0ebf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCurrentThreadId
FlsSetValue
RtlUnwindEx
EncodePointer
FlsGetValue
SetLastError
GetLastError
HeapFree
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetStdHandle
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
WriteFile
GetModuleFileNameW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Exports
Exports
t0b6zh
tkextent
tkextver
tkvercn1
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 512B - Virtual size: 456B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ