a
Static task
static1
Behavioral task
behavioral1
Sample
2dd531572e07aab11563222597af6240N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2dd531572e07aab11563222597af6240N.dll
Resource
win10v2004-20240709-en
General
-
Target
2dd531572e07aab11563222597af6240N.exe
-
Size
362KB
-
MD5
2dd531572e07aab11563222597af6240
-
SHA1
26d022e91d2be172d966d01ad3679d47f5712cc2
-
SHA256
f3798961c08ff71cb785232ef2120178d1ba556bf645d68b2a9ee8eb7ee6d4a4
-
SHA512
eec5ee15258a8fd0000ccc67ae7785d0495821a63c8a4e75062da63a1f2f4038c56955298a5c360e04d4a71f4b634fd6d1551c4a031df8787b404a8945b66312
-
SSDEEP
6144:37sx/IA34n9euS8Ybr762bGUqaiZUdTkHg3h5q2l9mV50DErpciW:37smA3P8YmjaiZUdwwq2lrDCci
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dd531572e07aab11563222597af6240N.exe
Files
-
2dd531572e07aab11563222597af6240N.exe.dll windows:6 windows x64 arch:x64
ca26d9a8ce73fd6b9a220ab68284db22
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
vr@s;6&`hi
trusaj|bS
hdwomh;6*aod
DdqLg`}haCjdlHbkaV
KddqLa{pvjz
KddqKvmep`
KddqIhdkg
KddqNvma
DdqQzkkE`aqmzu
DdqLg`}haMbfmjfQ
T`luNkzWmkddlIalabv
DdqDfravkknmgrUgvhc`lgW
DdqUmixTeqk_
@s``|aXvkff{zQ
DdqGahmEpqqakswcwV
FoqdzGzmpl`ieUfephml
OddwmGzmpl`ieUfephml
Joluaedm~`@z`rjeemQgcvigf
DdqVajlksvGa{c`rks{U
DdqWgh}iaLmnftngphmlW
DdqBgixqp`qFhkfQ
Onf`dBzaa
Lq`oEq|a|R
@s``|aEqp`{_
DdqB}vzajqW`{cbb
DdqMgcageiGz`pfUpsklgqW
DdqEzm~aP|sm^
WdwlajipaQkzlgg
DdqB}vzajqSzfefuwHf
Ssjbmw{M`Ql[lupokoKf
Q`lrmApgauwafh
QuiBit|qv`@ggrf~p
QuiMgkcqtCvfjrjijDlvr{
QuiWav|qeiVf~omb
JrAdjqocawSzlufhp
Vom`f`da`@{klvwokoDklvez
PdqTflij`iflL~`ctukmnDid|`q
WdwlajipaUqgjcpu
JrUsggmwwjqNlgwsvdRpeqef|
PdqMiw|Avwlz
DdqB}vzajqW`{cbbMe
Ddq@KT
DdqR|vajcQzxlQ
Joluaedm~`@z`rjeemQgcvigfDmeZy`fCiqou
Wmv@dhgg
WmvFmp^ehpf
WmvRmp^ehpf
WmvGzam
DdqUagcGkpm|
Es`dDmjvewz
OndeDmjvewzMqQ
OBH`xW|vmkd_
Gdid|aKvmqjkhjPcgukmn
JrS`dmlGkafXhaf
DdqNMIKT
DdqBXMfbk
FyluXvggavp
DdqLg`}haMbfmjfC|V
DdqQzkkawvKmhv
KddqZaIhhj`
EhkeNmzwpCjdlQ
EhkeKhgwa
EhkeFappBlom^
@s``|aNmh`T
DdqGahmPmhf
DdqGahmWmfMq
PdqGahmPmhf
orqskixmS
DdqGahmWmf
TslumBaha
DdqMiw|Avwlz
DdqB}vzajqSzfefuw
ThadKlivPjN}erjD}ug
NtiuaFqpaQl_`bfEl`p
PdqGahmTklm|ltF~
QddeNmda
Uhwu}edBv`f
Uhwu}edEhilk
@s``|a\lv`bl
@mjrmLij`if
QdidiwmIqqfp
Pm`dx
Fylu\lzaea
DdqT{az@acb}erOgjfKF
TslumGgjwjom^
DdqBgj{kh`Ngmc
DdqBgj{kh`@X
Empr`BahaGvnocqu
PdqR|`@ejaom
DdqGahmP}uf
DdqR|`@ejaom
DdqRqw|aiAfnhsorH`leIF
DdqT{az@acb}erVOH`leucgm
Es`dMj~mvjmelhwUpsklgqW
DdqDfravkknmgrPrvhlesU
DdqBgieejaOagcT
DdqBgieejaOagcB
EhkeFappBlomH
EhkeNmzwpCjdlC{G
DdqLg`}haCjdlHbka@
Joqdzhggo`gNespnWMkqt
QuiTfsaj`@{
Joluaedm~`PD`uwNa`f
Rt`sqTmvbjqehh`cGnwltgr
DdqR|ezpquJfoiT
DdqRqw|aiQjelGp@mmgVioe
Kddq[mra
bes@xm;6*aod
DdqOiim`W``}{owModmW
DdqRa`[qfDv|aiqopxAmult
DdqRa`[qfDv|aiqopx
Lq`oXvggavp\fmfh
Puds|Wmvrl`m^
Rt`sqWmvrl`mJim`mfU
Lq`o[azrmff_
@idooa[avsjklElhbheU
DdqDptdmglwMgrqoarDpooAkdR
Beot{p\ko`mX{ouohdegs
Onjj}tXvmsjdlafPemwgW
Lq`o\lzaeaWgbcm
PdqOiim`W``}{owModmW
DdqUgomjMkeg{kbrmnl
@mjrmWmvrl`mAgmbhd
Fopl[azrmff{ZrbrqrGzW
Lq`o[GEejddm{Q
Joluaedm~`PmjsqopxFgsaraxqls
PdqRmg}vmqzLlu`tmqvmrFakd
Bminke|aEkgAgowoemkxeQil
PdqDfpzmavJfHeoQ
Es`d[ml
DdqT{azJehf_
thki\px*`io
ThkI|pxUq`qqMgwgEwcklcbdm
ThkI|pxKt`m
ThkI|pxE`aQmxsfupIgcdgr{
ThkI|pxWakgZlwvcwu
ThkI|pxGkkmmjr
ThkI|pxKt`mZlwvcwu
ThkI|pxVaffacQcwqmlsg
ThkI|pxVadgLhrb
ThkI|pxGhjpmAgmbhd
@s\q\7:*`io
@s|q|W|vmkd\fDjhes{C
muamd*lhh
MuDebq{pTwj~`jfaarVmkgn
Qui@ln}wpUqaooccd
MuTtmvqW}vwmdOm`ksoctkof
QuiHfm|Qjl`gmcPrvhle
QuiDyqihQkjkfbfUpsklg
MuJqmj\lv`bl
MuFmgwm
MuJqmj\lv`bl]ihcjDz
QuiHxr<E`aqmzuWiWupkneW
MuLlxazwkkb|lRkta`f
nqw/lhd
TO`uMj}iV`pg|t`cS
TO`uKefgai@gghfephmlW
TO`uGtmjAkve^
TO`uKhgwa@m}d
TO`uI`lGkkmmjrjijV
pdftz7:*`io
OrdGzamVaqvzgDv`bdp
OrdFmpDkcjm[lupokoFctc
OrdDfqeavdwmEidijRgqskof{
piivita*`io
PuwR|vAS
S`qi]jyqkqf[yg`cwV
S`qiZaekr`BznuT
gov@xm&`hi
GovGzam
GovP}az}[R
Exports
Exports
Sections
.text Size: 247KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ