Static task
static1
Behavioral task
behavioral1
Sample
251ca5cc126b7ce62da84c9eb3770d60N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
251ca5cc126b7ce62da84c9eb3770d60N.dll
Resource
win10v2004-20240709-en
General
-
Target
251ca5cc126b7ce62da84c9eb3770d60N.exe
-
Size
600KB
-
MD5
251ca5cc126b7ce62da84c9eb3770d60
-
SHA1
a7f3efc5333a7a0e515973d8deac8a9c6bc4021d
-
SHA256
1ea90235e8bd6d8df9be7b46edd5522a5a95b7f1a29b906e143f6d3ea503d1b4
-
SHA512
060f33f72a86550e04f863e601fe9f935ab1556d83278355e24ceda2b395e29413ddc91dca1f092073f8c28b4f88912a9e0603b4d68f75f67ff3f2f59c7354b1
-
SSDEEP
12288:lc8RFv1SsODNmyesam1u4rUufyDmWVoyo:lc8vvSNmykmQsUiyDmWVoy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 251ca5cc126b7ce62da84c9eb3770d60N.exe
Files
-
251ca5cc126b7ce62da84c9eb3770d60N.exe.dll windows:6 windows x64 arch:x64
8f9ab65600d0baa6631fbe37f6acc3ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
CreateMutexA
Sleep
GetCurrentProcess
ExitProcess
CreateThread
GetTickCount
ReleaseMutex
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
LocalFree
GetLastError
CloseHandle
ReadFile
GetFileSize
CreateFileMappingW
CreateFileW
HeapSize
WriteConsoleW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
FindClose
FindFirstFileExA
advapi32
GetNamedSecurityInfoW
GetTokenInformation
EqualSid
OpenProcessToken
SetNamedSecurityInfoW
shell32
SHGetUnreadMailCountW
SHSetUnreadMailCountW
shlwapi
StrPBrkW
StrChrW
PathCanonicalizeA
dbghelp
ImageDirectoryEntryToData
SymSetOptions
SymGetOptions
ImageDirectoryEntryToDataEx
FindExecutableImage
urlmon
CoInternetGetSession
rpcrt4
MesEncodeFixedBufferHandleCreate
MesDecodeBufferHandleCreate
MesHandleFree
Sections
.text Size: 460KB - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ