Static task
static1
Behavioral task
behavioral1
Sample
4ba2a48ab55f6d82544024f7b0d4854a0b01c86b4eaf0a8a521b97390ed4b7d4.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4ba2a48ab55f6d82544024f7b0d4854a0b01c86b4eaf0a8a521b97390ed4b7d4.dll
Resource
win10v2004-20240704-en
General
-
Target
fa6fbb9de26f4ade1eeb87d74170389d.bin
-
Size
2.3MB
-
MD5
0682fb7fe999d3571e146b989a825196
-
SHA1
cf4c50c0b4e415e904d7a2541581235375cfc8c1
-
SHA256
d2b5511b67d28e098d08d8ae66f77ee59d5c1d466347544a4ebeb1eea8f29eaa
-
SHA512
edac76bc67b7cc79e517382736c139417e72fa0134c499fad3729787a6acf7e81284fc914e58c431bd5719c99e93f5881dd9d69596dcab23906c861de45e6d3b
-
SSDEEP
49152:/lz59+feVFr3V8HcnBejO909IwbmMUq1VsYNMov5W/ZjFVmD5kr:/lz6feVFLV30GwbbV/KjFVgkr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4ba2a48ab55f6d82544024f7b0d4854a0b01c86b4eaf0a8a521b97390ed4b7d4.dll
Files
-
fa6fbb9de26f4ade1eeb87d74170389d.bin.zip
Password: infected
-
4ba2a48ab55f6d82544024f7b0d4854a0b01c86b4eaf0a8a521b97390ed4b7d4.dll.dll windows:5 windows x86 arch:x86
Password: infected
08b0e89f513b9808ba656ef03cf23f6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
CryptDestroyKey
DeleteService
version
VerQueryValueA
user32
ToAsciiEx
SetMenu
ShowCaret
LoadAcceleratorsW
UnregisterHotKey
gdi32
FillPath
GetNearestColor
GetMetaFileA
msvcrt
memset
kernel32
GetSystemInfo
DebugActiveProcess
GlobalDeleteAtom
GetConsoleCP
SetCommConfig
SetThreadPriority
GetBinaryTypeA
GetModuleFileNameA
LoadLibraryW
GetSystemTimeAsFileTime
OutputDebugStringA
LoadLibraryExA
LoadLibraryExW
winmm
waveInGetDevCapsA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 344KB - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dJikU40 Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XJv48hjo Size: 432KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 21KB
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ