GetObjectCount
Static task
static1
Behavioral task
behavioral1
Sample
e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.dll
Resource
win7-20240704-es
Behavioral task
behavioral2
Sample
e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.dll
Resource
win10v2004-20240709-es
General
-
Target
e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe
-
Size
116KB
-
MD5
9f9723c5ff4ec1b7f08eb2005632b8b1
-
SHA1
e47a821ef85d722f01f10adff227f45552e4ec73
-
SHA256
e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4
-
SHA512
3f222302d039337493736cd865c4b7c91d9a064b0ca68a7f3254bf0f35d4abc69da7f89096a3333e527730b81f142b3b608ee3313e050c061c11c14c7261f8d0
-
SSDEEP
3072:Z3EKsekGvHowEu//WfW0JTtLVbZDe6n7KSNM:REKsekco0/2WEgCu/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe
Files
-
e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe.dll windows:6 windows x86 arch:x86
Password: infected
068f62d1a1585dae9a2a72ce94d7d900
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyW
GetTickCount
CreateEventW
CloseHandle
WaitForSingleObject
ResetEvent
SetEvent
GetSystemInfo
GlobalMemoryStatusEx
GetComputerNameW
GetComputerNameExW
GetACP
GetOEMCP
GetPriorityClass
GetCurrentProcess
GetThreadPriority
GetCurrentThread
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
GetNativeSystemInfo
CreateFileW
DeleteCriticalSection
SetFilePointerEx
ReadFile
WriteFile
DeleteFileW
GetTempPathW
GetCurrentThreadId
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
GetFileSize
TerminateProcess
GetStdHandle
CreatePipe
SetStdHandle
DuplicateHandle
CreateProcessW
WriteConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
DecodePointer
RaiseException
GetLastError
Sleep
InitializeCriticalSectionEx
GetModuleFileNameW
OutputDebugStringA
GetFileSizeEx
lstrlenW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapReAlloc
HeapSize
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetFileType
GetStringTypeW
LCMapStringW
user32
CharLowerW
CharUpperW
wsprintfW
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegOpenKeyW
RegQueryValueExW
ole32
CoCreateGuid
shlwapi
StrStrW
StrCmpW
StrCpyW
ws2_32
WSAStartup
GetAddrInfoW
FreeAddrInfoW
WSACleanup
send
connect
setsockopt
recv
closesocket
htons
socket
Exports
Exports
Sections
.text Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ