AwcdthodsHlu
Static task
static1
Behavioral task
behavioral1
Sample
9e129b175f23768c6eba3262f073eb5a087a89f19625e2c56811f1d903142b95.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
9e129b175f23768c6eba3262f073eb5a087a89f19625e2c56811f1d903142b95.dll
Resource
win11-20240709-en
General
-
Target
9e129b175f23768c6eba3262f073eb5a087a89f19625e2c56811f1d903142b95
-
Size
1.7MB
-
MD5
3d5502954bf84c54123cec423d5b5843
-
SHA1
e91ecf8a3e0f8e6ddbe8b7c5e41d4aece7cc6efb
-
SHA256
9e129b175f23768c6eba3262f073eb5a087a89f19625e2c56811f1d903142b95
-
SHA512
e3201fba0a86d10cc4b33f10e56c99bb49b20f7b0a2f92b0cd7937687fd6d7b3bfd48f47dcfab125b36e2a392797c2f2c10782e2b3cea956b951a8364371c4f2
-
SSDEEP
24576:wbLnMsm0G2mQU0M4LGYr59b/xxu0MktFGM8qpoeLow2lnuCU2+UNU4LeapIP31:Wn82tM4LGYr5Bju26qpoQoVln9U+Vpa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e129b175f23768c6eba3262f073eb5a087a89f19625e2c56811f1d903142b95
Files
-
9e129b175f23768c6eba3262f073eb5a087a89f19625e2c56811f1d903142b95.dll windows:5 windows x86 arch:x86
4657c1ce8d5cf5f56cc7c93992f0d432
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mprapi
MprAdminTransportGetInfo
user32
GetMenuContextHelpId
SetForegroundWindow
oleaut32
GetRecordInfoFromGuids
gdi32
SetDCPenColor
kernel32
LeaveCriticalSection
OutputDebugStringA
GetStringTypeA
GetModuleHandleW
GetModuleHandleA
AreFileApisANSI
SetPriorityClass
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
GetLastError
CompareStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeW
EnterCriticalSection
HeapFree
Sleep
ExitProcess
GetLocaleInfoA
HeapAlloc
InitializeCriticalSectionAndSpinCount
WriteFile
GetStdHandle
GetModuleFileNameA
VirtualFree
VirtualAlloc
HeapReAlloc
LoadLibraryA
RtlUnwind
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 448KB - Virtual size: 445KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 105KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ