Static task
static1
Behavioral task
behavioral1
Sample
16ed2cb4ec3a55898e701165c4fcf702abfecd1b8fc1a8fa9c37bc8bb4570298.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
16ed2cb4ec3a55898e701165c4fcf702abfecd1b8fc1a8fa9c37bc8bb4570298.dll
Resource
win10v2004-20240704-en
General
-
Target
fa3fda62bd5eee55b1f3c5cbf1c75554.bin
-
Size
2.3MB
-
MD5
d87b4a175d0d517011178f0c4c43abce
-
SHA1
1a53a01325b0ceafae8db7d0f0d54cb3305e9bc4
-
SHA256
8d774246f5223f0cbfaef5e49c666fed05e9addd90b6570a4cc8eb4e9e3d0ad4
-
SHA512
eb92ede35f13366f02c7fe0bcc59f1b4a4aae60a13e8ea4831e3122b76a0d1298cd4538acad5b3bd496cb6b81e36393ef2aa241653ee2c54aca6d9f8a12b94e5
-
SSDEEP
49152:WHo6AnoVEcnlvK5JQ7Yotp2+ldvK+8GjyegqQqPXyUIJOQ66mM:WITwhiw7BVdC+8d1qQqPXDIJOvM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/16ed2cb4ec3a55898e701165c4fcf702abfecd1b8fc1a8fa9c37bc8bb4570298.dll
Files
-
fa3fda62bd5eee55b1f3c5cbf1c75554.bin.zip
Password: infected
-
16ed2cb4ec3a55898e701165c4fcf702abfecd1b8fc1a8fa9c37bc8bb4570298.dll.dll windows:5 windows x86 arch:x86
Password: infected
96ead47adbf8ce95c1a9fe6413dfb704
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
CryptDestroyKey
DeleteService
version
VerQueryValueA
msvcrt
memset
user32
ToAsciiEx
SetMenu
ShowCaret
LoadAcceleratorsW
UnregisterHotKey
gdi32
FillPath
GetNearestColor
GetMetaFileA
kernel32
GetSystemInfo
DebugActiveProcess
GlobalDeleteAtom
GetConsoleCP
SetCommConfig
SetThreadPriority
GetBinaryTypeA
GetModuleFileNameA
LoadLibraryW
GetSystemTimeAsFileTime
OutputDebugStringA
LoadLibraryExA
LoadLibraryExW
winmm
waveInGetDevCapsA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 344KB - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dJikU40 Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XJv48hjo Size: 432KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 21KB
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ