EhckewmiraarldeQnd
Static task
static1
Behavioral task
behavioral1
Sample
5077167a1ba7cda925ddd17b42d903103769ec81d4c7d43efe6ba54689d52f4c.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5077167a1ba7cda925ddd17b42d903103769ec81d4c7d43efe6ba54689d52f4c.dll
Resource
win10v2004-20240709-en
General
-
Target
5077167a1ba7cda925ddd17b42d903103769ec81d4c7d43efe6ba54689d52f4c
-
Size
2.0MB
-
MD5
ce4103aa33a8ae21c89722c0fd75dd4b
-
SHA1
43b90e0c9471adefb1ca11b6294402e60629aa0a
-
SHA256
5077167a1ba7cda925ddd17b42d903103769ec81d4c7d43efe6ba54689d52f4c
-
SHA512
dc7dff9e8a0240909c38558ff2ebcb892c48ce4855304c075a619ac78f4e57255cfc41aee9ea67b343bc5dd61343c19cd0bd731bf7879ede8a2d555fca882421
-
SSDEEP
49152:WT+bch5KDiXet0Dep+NeyV8CkyNAANZxucHOqKnFWno7Z:WGcKDiXet0Dep+QyVdkyNAANHSqKnMnm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5077167a1ba7cda925ddd17b42d903103769ec81d4c7d43efe6ba54689d52f4c
Files
-
5077167a1ba7cda925ddd17b42d903103769ec81d4c7d43efe6ba54689d52f4c.dll windows:5 windows x86 arch:x86
7eb8dac0240763d8e3ee05d83dc549ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
crypt32
CryptQueryObject
CertNameToStrW
kernel32
CompareStringW
CompareStringA
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetVolumeNameForVolumeMountPointW
LeaveCriticalSection
CreateSemaphoreW
GetShortPathNameA
GetWindowsDirectoryA
QueryPerformanceCounter
GetSystemDefaultUILanguage
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
DuplicateHandle
GlobalDeleteAtom
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
EnumResourceLanguagesW
GlobalMemoryStatusEx
GetEnvironmentStringsW
CreatePipe
GetLocaleInfoW
HeapSize
GetCommandLineA
CloseHandle
CreateFileA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
VirtualAlloc
HeapReAlloc
HeapAlloc
ReadFile
VirtualFree
HeapDestroy
HeapCreate
GetModuleFileNameA
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FatalAppExitA
Sleep
HeapFree
GetModuleHandleW
GetProcAddress
ExitProcess
SetFilePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
RtlUnwind
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
SetEnvironmentVariableA
shell32
ExtractAssociatedIconW
ShellExecuteExW
Shell_NotifyIconA
SHGetFileInfoW
ExtractAssociatedIconExW
advapi32
GetSecurityDescriptorControl
SaferSetPolicyInformation
NotifyBootConfigStatus
SaferCreateLevel
wininet
InternetGetCookieW
winscard
SCardConnectW
rasapi32
RasEnumConnectionsW
esent
JetSetIndexRange
setupapi
SetupDiEnumDeviceInfo
opengl32
glOrtho
ole32
CoWaitForMultipleHandles
CoResumeClassObjects
shlwapi
StrFormatKBSizeA
gdi32
SetViewportOrgEx
PolyTextOutA
Polyline
GetKerningPairsA
PlgBlt
TranslateCharsetInfo
urlmon
CreateAsyncBindCtxEx
CoInternetQueryInfo
winmm
mmioGetInfo
waveOutGetDevCapsW
waveInGetID
mprapi
MprInfoBlockSet
user32
SendNotifyMessageA
SetRect
FindWindowExW
CreateIcon
SetMenuItemInfoW
SetCursorPos
PtInRect
rpcrt4
UuidCreateNil
lz32
GetExpandedNameW
Exports
Exports
Sections
.text Size: 904KB - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qdata Size: 884KB - Virtual size: 881KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ