Static task
static1
Behavioral task
behavioral1
Sample
6797bc9e07e7821c4c6ae8846601915e5afa08cb2a51402d535a56590cb7d9b5.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
6797bc9e07e7821c4c6ae8846601915e5afa08cb2a51402d535a56590cb7d9b5.dll
Resource
win10v2004-20240802-en
General
-
Target
6797bc9e07e7821c4c6ae8846601915e5afa08cb2a51402d535a56590cb7d9b5
-
Size
154KB
-
MD5
8ea493a9b73c79dfdfa3db68eb55c212
-
SHA1
04cb3c2e4aa019cb1b14741cfbb4be385edff53a
-
SHA256
6797bc9e07e7821c4c6ae8846601915e5afa08cb2a51402d535a56590cb7d9b5
-
SHA512
89d4ba3a0610d491e7415aa07cce39bb2f5d9604c7d12c6ffc2874eafcdc6b2fbecae09095452e0fe4fa573027c2202fe34375806bba1d3cd0be97fbf326a977
-
SSDEEP
3072:ksIG7J17WPK/gdnH+xqyRfdAmse6zOSIwf8KY2AJ6yzgriVfRdVeuh8ZbXsOKyKw:ksIGF17WPK/g5+waemse6z9aVvJ6yasi
Malware Config
Signatures
Files
-
6797bc9e07e7821c4c6ae8846601915e5afa08cb2a51402d535a56590cb7d9b5.dll windows:5 windows x86 arch:x86
57058ba4e825986affe9a6ebeab5a19d
Code Sign
3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:beCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After02/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US04:00:00:00:00:01:2f:4e:e1:52:d7Certificate
IssuerCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BENot Before13/04/2011, 10:00Not After28/01/2028, 12:00SubjectCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageCertSign
KeyUsageCRLSign
11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate
IssuerCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BENot Before03/02/2015, 00:00Not After03/03/2026, 00:00SubjectCN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SGExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before08/11/2006, 00:00Not After07/11/2021, 23:59SubjectCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
06:4d:f5:38:cf:03:00:68:9d:ee:d6:03:d1:0f:7a:00Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before31/01/2013, 00:00Not After31/03/2016, 23:59SubjectCN=MarkAny Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=MarkAny Inc.,L=Jung-gu,ST=Seoul,C=KRExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\Users\mkSong\Desktop\imgsf50\79. 20150804\Release\IMGSF50Filter.pdb
Imports
kernel32
VerifyVersionInfoW
GetCurrentProcess
lstrcmpiW
DuplicateHandle
GetCurrentThread
GetCurrentThreadId
InitializeCriticalSection
LoadLibraryW
DisableThreadLibraryCalls
OpenFileMappingW
DeleteCriticalSection
LocalFree
OpenEventW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
SetLastError
VerSetConditionMask
VirtualProtect
GetThreadContext
SetThreadContext
InterlockedCompareExchange
FlushInstructionCache
VirtualAlloc
SuspendThread
ResumeThread
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
VirtualQuery
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
ReleaseMutex
Sleep
CreateMutexW
CloseHandle
WaitForSingleObject
GetProcAddress
GetFileAttributesW
MultiByteToWideChar
HeapAlloc
WideCharToMultiByte
FormatMessageA
GetLastError
GetProcessHeap
HeapFree
CreateDirectoryA
GetCurrentProcessId
GetModuleFileNameA
OutputDebugStringA
lstrlenA
GetModuleFileNameW
GetVersionExW
GetModuleHandleW
LoadLibraryA
user32
GetWindowRect
ReleaseDC
WindowFromDC
GetSystemMetrics
IntersectRect
OffsetRect
GetWindow
IsWindowVisible
IsIconic
SetRect
FillRect
InvalidateRect
GetWindowLongW
SetWindowsHookExW
GetClientRect
CallNextHookEx
OpenClipboard
GetDC
EmptyClipboard
SetClipboardData
CloseClipboard
GetForegroundWindow
GetClassNameW
WindowFromPoint
ChildWindowFromPointEx
UpdateWindow
GetKeyState
SetWindowLongA
SetWindowLongW
GetWindowLongA
CallWindowProcA
CallWindowProcW
RemovePropW
EndPaint
DrawTextW
GetClassLongW
GetCursorPos
GetWindowDC
FindWindowW
GetAncestor
GetDesktopWindow
GetWindowPlacement
GetParent
IsWindow
GetWindowThreadProcessId
BeginPaint
ShowWindow
SetPropW
GetPropW
DefWindowProcA
DefWindowProcW
IsWindowUnicode
UnhookWindowsHookEx
gdi32
BitBlt
CreateRectRgnIndirect
GetStockObject
CombineRgn
GetDeviceCaps
FillRgn
CreateRectRgn
SetBkMode
GetObjectType
SetViewportOrgEx
CreateCompatibleBitmap
DeleteObject
SelectObject
DeleteDC
CreateDIBSection
OffsetRgn
CreateCompatibleDC
advapi32
RegCloseKey
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegCreateKeyExW
GetUserNameW
RegSetValueExW
shell32
SHGetSpecialFolderPathW
ord165
ole32
CoTaskMemFree
msvcp90
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??_D?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
?open@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXPBDHH@Z
?close@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?uncaught_exception@std@@YA_NXZ
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
??0locale@std@@QAE@PBDH@Z
??1locale@std@@QAE@XZ
shlwapi
PathFindFileNameA
PathAppendA
PathFileExistsA
PathFindFileNameW
StrCmpW
StrCmpIW
msvcr90
memmove_s
??3@YAXPAX@Z
free
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_vsnprintf
_vsnwprintf
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_invalid_parameter_noinfo
_localtime64_s
_time64
malloc
_beginthreadex
?what@exception@std@@UBEPBDXZ
realloc
_wcsicmp
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CxxThrowException
_except_handler4_common
__clean_type_info_names_internal
exit
fprintf
__iob_func
sprintf
memset
memcpy
sscanf
getenv
__CxxFrameHandler3
memcpy_s
psapi
GetProcessImageFileNameW
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MUILANG Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ