Static task
static1
Behavioral task
behavioral1
Sample
ef16511d861bbd409f27e3d65520cce0N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ef16511d861bbd409f27e3d65520cce0N.dll
Resource
win10v2004-20240709-en
General
-
Target
ef16511d861bbd409f27e3d65520cce0N.exe
-
Size
66KB
-
MD5
ef16511d861bbd409f27e3d65520cce0
-
SHA1
d9fbec3eb01528e29156e4dba577e680964e1ee4
-
SHA256
85b31dad5ad369801cbcb51ba1c1ff4376fce0277151357a3dad180e580df964
-
SHA512
5bb6d75776813cf6bbcdded2474ef1662a8a3a06cc141daffe60c94ad201c5fa7efdfb1a08dfc34777a03ac594bb6b5f19703a6f9956253f0548a5cf9b5b43d8
-
SSDEEP
768:Lh63sRqHLSe0VZi+dYsThfVOub3AjuXaYkQ934BQei25X6PLvN23AatBcccccccv:Lh7RqlGAQ9fVFDAjuXaKlow6qDl8PI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef16511d861bbd409f27e3d65520cce0N.exe
Files
-
ef16511d861bbd409f27e3d65520cce0N.exe.dll windows:4 windows x64 arch:x64
f72dc75b26930cfd672fedc19c3e5a7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
cygwin1
__cxa_atexit
__getreent
__locale_ctype_ptr
__stack_chk_fail
__stack_chk_guard
_impure_ptr
calloc
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
exit
fclose
fdopen
fflush
fgetc
fopen
fprintf
fputc
fread
free
fwrite
malloc
posix_memalign
realloc
stpcpy
strlen
ungetc
kernel32
GetModuleHandleA
Exports
Exports
BZ2_blockSort
BZ2_bsInitWrite
BZ2_bzBuffToBuffCompress
BZ2_bzBuffToBuffDecompress
BZ2_bzCompress
BZ2_bzCompressEnd
BZ2_bzCompressInit
BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit
BZ2_bzRead
BZ2_bzReadClose
BZ2_bzReadGetUnused
BZ2_bzReadOpen
BZ2_bzWrite
BZ2_bzWriteClose
BZ2_bzWriteClose64
BZ2_bzWriteOpen
BZ2_bz__AssertH__fail
BZ2_bzclose
BZ2_bzdopen
BZ2_bzerror
BZ2_bzflush
BZ2_bzlibVersion
BZ2_bzopen
BZ2_bzread
BZ2_bzwrite
BZ2_compressBlock
BZ2_crc32Table
BZ2_decompress
BZ2_hbAssignCodes
BZ2_hbCreateDecodeTables
BZ2_hbMakeCodeLengths
BZ2_indexIntoF
BZ2_rNums
__gcc_deregister_frame
__gcc_register_frame
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: 512B - Virtual size: 53B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 432B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ