crashHandler
Static task
static1
Behavioral task
behavioral1
Sample
4d9cab97980b88e4223d91a6f93422f0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4d9cab97980b88e4223d91a6f93422f0N.dll
Resource
win10v2004-20240709-en
General
-
Target
4d9cab97980b88e4223d91a6f93422f0N.exe
-
Size
333KB
-
MD5
4d9cab97980b88e4223d91a6f93422f0
-
SHA1
033105ff3e85b89216c45274000fa2d932dcf51d
-
SHA256
7c40e487ca4cbb8dffeefc3e50c1d849d3271413ac88133e7cb5ebcf09e3cbd1
-
SHA512
b04b1fbbb0869b159925d63cbccd2bf28846e254e37497d9f166cfbee6bc5095a6ad8581d0e5bb9d2daf8bab93d73b4bd271decfa031cd9e0e433f58b280368d
-
SSDEEP
6144:aAZOpxxhubzl/q0m++aIpLXY9yt9PzTmaYLwERIYEBTt:m5XTLXcaB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d9cab97980b88e4223d91a6f93422f0N.exe
Files
-
4d9cab97980b88e4223d91a6f93422f0N.exe.dll windows:5 windows x64 arch:x64
88ed46fd1993015ea3eabd22970e0831
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
oleacc
AccessibleObjectFromWindow
AccessibleObjectFromPoint
kernel32
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrlenA
GetProcAddress
LoadLibraryA
FreeLibrary
LocalFree
OpenProcess
CloseHandle
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetModuleHandleA
TerminateProcess
GetTickCount
GetCurrentProcessId
LoadLibraryExA
GetCommandLineA
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
SetLastError
RaiseException
DeleteCriticalSection
LoadLibraryExW
VirtualQuery
VirtualFree
VirtualAlloc
GetSystemInfo
GetThreadContext
LeaveCriticalSection
SetThreadContext
HeapAlloc
HeapFree
Sleep
HeapDestroy
HeapCreate
OpenThread
VirtualProtect
SuspendThread
ResumeThread
GetNamedPipeHandleStateA
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
RtlUnwindEx
GetStartupInfoW
GetFileType
SetHandleCount
GetStringTypeW
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
WriteFile
FlsAlloc
FlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetVersion
HeapSetInformation
ExitProcess
GetModuleHandleW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetLastError
CompareStringW
GetCPInfo
HeapReAlloc
FlushFileBuffers
LocalAlloc
HeapSize
GetProcessHeap
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeCriticalSection
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
FlsSetValue
RtlPcToFileHeader
RtlLookupFunctionEntry
LCMapStringW
user32
IsWindowVisible
GetWindowLongA
CallNextHookEx
RegisterWindowMessageA
CallWindowProcA
CreateWindowExA
GetWindowLongPtrA
SetWindowLongPtrA
DestroyWindow
DefWindowProcA
LoadCursorA
GetClassInfoExA
RegisterClassExA
ClientToScreen
LockWindowUpdate
KillTimer
GetForegroundWindow
VkKeyScanExA
LoadKeyboardLayoutA
MapVirtualKeyA
SetTimer
SendMessageA
GetKeyState
CharLowerBuffA
PostMessageA
FindWindowExA
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetClassNameA
SendInput
IsWindow
UnregisterClassA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
Exports
Exports
Sections
.text Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ