Static task
static1
Behavioral task
behavioral1
Sample
bde21d747e2cfdbe2a510a8bafabf580N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bde21d747e2cfdbe2a510a8bafabf580N.dll
Resource
win10v2004-20240709-en
General
-
Target
bde21d747e2cfdbe2a510a8bafabf580N.exe
-
Size
20KB
-
MD5
bde21d747e2cfdbe2a510a8bafabf580
-
SHA1
9528f989a8c31d26737517d8869b1a2e3c1ca3b5
-
SHA256
d79a41a71b83a9fdcff3ea4c6beab29c4d657114804a2dd7cdccc4a9f001b900
-
SHA512
9b08ad5cb01adf0788e24bdb817a545111d1f00b8a4675afb7c350c9b2c67d2a09b21e7b5ca2219a249eeac4349d547bfc1ff646c76e38aae6e88fcccad8192f
-
SSDEEP
384:WzG+YTx8K0s3eSSNR5spCJl/Mc6uuhymjnAS0v2MRm1B4hl9JoJcLHg2vC:WK+YTCnSSx7MjFhy+0Dm1KlroF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bde21d747e2cfdbe2a510a8bafabf580N.exe
Files
-
bde21d747e2cfdbe2a510a8bafabf580N.exe.dll windows:4 windows x86 arch:x86
a3103b6308bba51dbeb2a1ab59ca0a86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
InitializeCriticalSection
TerminateProcess
GetCurrentProcessId
TerminateThread
IsBadReadPtr
GetPrivateProfileStringA
WideCharToMultiByte
RaiseException
CloseHandle
GetCurrentThread
Process32Next
GlobalAlloc
CreateToolhelp32Snapshot
ReadProcessMemory
WriteProcessMemory
GlobalLock
GlobalUnlock
GlobalFree
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetProcAddress
GetCurrentProcess
VirtualProtectEx
CreateMutexA
GetModuleFileNameA
CreateThread
OpenMutexA
Process32First
user32
FindWindowA
GetWindowThreadProcessId
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
ws2_32
WSASetLastError
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
msvcrt
strncpy
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fread
fclose
strstr
strrchr
memcpy
strcpy
atoi
strchr
memset
strcat
sprintf
??2@YAPAXI@Z
_strlwr
??3@YAXPAX@Z
sscanf
strlen
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ