KefbtiqdLsxnsflwofd
Static task
static1
Behavioral task
behavioral1
Sample
34170ee8c5572e337350df568df185f0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
34170ee8c5572e337350df568df185f0N.dll
Resource
win10v2004-20240709-en
General
-
Target
34170ee8c5572e337350df568df185f0N.exe
-
Size
2.5MB
-
MD5
34170ee8c5572e337350df568df185f0
-
SHA1
eba357788401be5508f6430100fc39b760096efc
-
SHA256
8125d54c1cf8c2380d5a269587ad761e2d3fcbf2de728cac95431f36c0c497d7
-
SHA512
57493fe3be9842302650e97214c8bb865c35560b6db52fd637628ddbd4aa09887d142d57e35e0a250d3fc18d765ed88d3a61759c1b62d04727e6d0009650b7ed
-
SSDEEP
49152:GM2GPVp8kql0/MyhWsudSYtD1DBVCbfiROYx+uwgJsS1q4zSBs9m:GM2Yj1MoWsGSYtDxAEZx+uwO1q4zQsE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34170ee8c5572e337350df568df185f0N.exe
Files
-
34170ee8c5572e337350df568df185f0N.exe.dll windows:5 windows x86 arch:x86
be6666ab5be317cbd3f32105639cb926
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
gdi32
SetTextJustification
GetFontUnicodeRanges
PtVisible
GetPath
CreateEllipticRgn
CreateCompatibleDC
GetGraphicsMode
PolyTextOutA
shell32
DragQueryFileA
SHGetFileInfoA
version
GetFileVersionInfoW
kernel32
GetFileSize
OutputDebugStringA
GetModuleFileNameA
WaitForSingleObjectEx
GetNativeSystemInfo
FindVolumeClose
VerSetConditionMask
CreateTimerQueue
GetThreadPriority
HeapUnlock
SetStdHandle
LoadLibraryW
comctl32
ImageList_Add
mprapi
MprAdminInterfaceGetHandle
MprAdminPortDisconnect
netapi32
NetGroupGetUsers
rpcrt4
NdrConformantStringBufferSize
RpcBindingToStringBindingA
advapi32
DeleteAce
BackupEventLogW
wintrust
CryptCATAdminCalcHashFromFileHandle
msvcrt
wcscoll
memset
winmm
auxGetDevCapsW
user32
CreateIconFromResource
IsWindowUnicode
WaitMessage
GetCaretBlinkTime
SetWindowContextHelpId
ActivateKeyboardLayout
GetMenu
WindowFromDC
ntdsapi
DsReplicaFreeInfo
clusapi
ClusterOpenEnum
setupapi
CM_Get_Device_Interface_List_Size_ExW
SetupQueueDeleteW
SetupDiSetDeviceRegistryPropertyA
SetupDiGetClassImageList
pdh
PdhEnumObjectItemsHW
ole32
CoDisableCallCancellation
OleQueryCreateFromData
OleConvertOLESTREAMToIStorage
oleaut32
LoadTypeLibEx
Exports
Exports
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.crt Size: 4KB - Virtual size: 749B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_READ
.data Size: 88KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 804KB - Virtual size: 803KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ