EhckewmiraarldeQnd
Static task
static1
Behavioral task
behavioral1
Sample
8bed95f08400685e5a4d3aba296fcfa6f31064518aa5789c947690b0ba3e05a5.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8bed95f08400685e5a4d3aba296fcfa6f31064518aa5789c947690b0ba3e05a5.dll
Resource
win10v2004-20240709-en
General
-
Target
8bed95f08400685e5a4d3aba296fcfa6f31064518aa5789c947690b0ba3e05a5
-
Size
2.0MB
-
MD5
ade9fbbfccf6d9665733596e06e38844
-
SHA1
6c0d4abca947b89714351dfcb0f1db25cd8d6c28
-
SHA256
8bed95f08400685e5a4d3aba296fcfa6f31064518aa5789c947690b0ba3e05a5
-
SHA512
370d6b43b7b38a1ef3094e67d6f4075c267aa5321dae91fbf776baaa17e7637f42cdee6cf1da8a028ac9700c7ec139aca3f713138f888abbc26f83d91532524a
-
SSDEEP
49152:Wh+bch5KDiXet0Dep+NDy38CkyNAANZxucHOqKnFWno7Z:WAcKDiXet0Dep+hy3dkyNAANHSqKnMnm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bed95f08400685e5a4d3aba296fcfa6f31064518aa5789c947690b0ba3e05a5
Files
-
8bed95f08400685e5a4d3aba296fcfa6f31064518aa5789c947690b0ba3e05a5.dll windows:5 windows x86 arch:x86
75504dfefe46e3625505d5f551a2067f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
crypt32
CryptQueryObject
CertNameToStrW
kernel32
CompareStringW
CompareStringA
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetVolumeNameForVolumeMountPointW
LeaveCriticalSection
CreateSemaphoreW
GetShortPathNameA
GetWindowsDirectoryA
QueryPerformanceCounter
GetSystemDefaultUILanguage
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
DuplicateHandle
GlobalDeleteAtom
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
EnumResourceLanguagesW
GlobalMemoryStatusEx
GetEnvironmentStringsW
CreatePipe
GetLocaleInfoW
HeapSize
GetCommandLineA
CloseHandle
CreateFileA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
VirtualAlloc
HeapReAlloc
HeapAlloc
ReadFile
VirtualFree
HeapDestroy
HeapCreate
GetModuleFileNameA
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FatalAppExitA
Sleep
HeapFree
GetModuleHandleW
GetProcAddress
ExitProcess
SetFilePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
RtlUnwind
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
SetEnvironmentVariableA
shell32
ExtractAssociatedIconW
ShellExecuteExW
Shell_NotifyIconA
SHGetFileInfoW
ExtractAssociatedIconExW
advapi32
GetSecurityDescriptorControl
SaferSetPolicyInformation
NotifyBootConfigStatus
SaferCreateLevel
shlwapi
StrFormatKBSizeA
winscard
SCardConnectW
rasapi32
RasEnumConnectionsW
opengl32
glOrtho
setupapi
SetupDiEnumDeviceInfo
esent
JetSetIndexRange
ole32
CoWaitForMultipleHandles
CoResumeClassObjects
wininet
InternetGetCookieW
gdi32
SetViewportOrgEx
PolyTextOutA
Polyline
GetKerningPairsA
PlgBlt
TranslateCharsetInfo
urlmon
CreateAsyncBindCtxEx
CoInternetQueryInfo
winmm
mmioGetInfo
waveOutGetDevCapsW
waveInGetID
mprapi
MprInfoBlockSet
user32
SendNotifyMessageA
SetRect
FindWindowExW
CreateIcon
SetMenuItemInfoW
SetCursorPos
PtInRect
rpcrt4
UuidCreateNil
lz32
GetExpandedNameW
Exports
Exports
Sections
.text Size: 904KB - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qdata Size: 884KB - Virtual size: 881KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ