EhckewmiraarldeQnd
Static task
static1
Behavioral task
behavioral1
Sample
66ca7f57916c6e7a821ab0e1f522ca00N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
66ca7f57916c6e7a821ab0e1f522ca00N.dll
Resource
win10v2004-20240709-en
General
-
Target
66ca7f57916c6e7a821ab0e1f522ca00N.exe
-
Size
2.6MB
-
MD5
66ca7f57916c6e7a821ab0e1f522ca00
-
SHA1
b2a14bc0ac442024b365030b16de8ef51a127662
-
SHA256
197484043a925559c169207b3678647539efecc2779c700459fafc1100731e8c
-
SHA512
0564b4e3ca3480a507aefef1bdec8372d421adbaad65814e5422dcbccf395ac2cc79ef388d4c4e38442ecd7b470ee62f98fb380bb59bfdd4864f4097dbf5043a
-
SSDEEP
49152:+02SlZPHqr5BdJ1IFOAriWIDvEdJQmw5TsftENDq64gj2Y264uDJ:+02SlZPEfJWFOArTIDsdrw5wfSNq1gj/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66ca7f57916c6e7a821ab0e1f522ca00N.exe
Files
-
66ca7f57916c6e7a821ab0e1f522ca00N.exe.dll windows:5 windows x86 arch:x86
01745cb3b1cb806f1762eeed82f5b28a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
rpcrt4
NdrPointerBufferSize
rasapi32
RasDialA
mprapi
MprInfoDuplicate
shlwapi
SHDeleteKeyA
ChrCmpIA
PathFindExtensionA
UrlIsOpaqueW
SHDeleteEmptyKeyW
StrRetToBSTR
wininet
InternetAutodial
opengl32
glGetString
winscard
SCardCancel
winmm
midiInGetDevCapsA
SendDriverMessage
midiOutGetDevCapsW
gdi32
Arc
PolyPolygon
GetSystemPaletteUse
SetMiterLimit
GetOutlineTextMetricsW
RectVisible
ole32
CoGetObject
CoWaitForMultipleHandles
user32
MessageBoxIndirectA
SubtractRect
CharNextW
SetDlgItemTextA
DrawStateW
InvertRect
WaitForInputIdle
advapi32
EnumServicesStatusW
QueryServiceConfigA
NotifyBootConfigStatus
QueryServiceLockStatusW
esent
JetSeek
urlmon
IsAsyncMoniker
CoInternetParseUrl
kernel32
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
CloseHandle
GetLocaleInfoW
HeapSize
GetConsoleMode
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
GetTimeZoneInformation
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
HeapReAlloc
VirtualAlloc
CompareStringA
CompareStringW
SetEnvironmentVariableA
RtlUnwind
HeapAlloc
GetModuleFileNameA
HeapCreate
HeapDestroy
TlsFree
CreateMailslotA
GetEnvironmentStrings
lstrlenW
LoadLibraryExA
GetBinaryTypeA
SetWaitableTimer
GetPrivateProfileIntW
GetOEMCP
GetThreadPriority
GetModuleHandleA
OutputDebugStringA
GetModuleFileNameW
GlobalDeleteAtom
DuplicateHandle
GetSystemDefaultUILanguage
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
GetConsoleCP
SetLastError
GetCurrentThreadId
GetLastError
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FatalAppExitA
HeapFree
Sleep
ExitProcess
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
InitializeCriticalSectionAndSpinCount
WriteFile
VirtualFree
crypt32
CertRDNValueToStrW
CertGetNameStringW
setupapi
SetupDiEnumDeviceInfo
Exports
Exports
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qdata Size: 1004KB - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 420KB - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 216KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ