taskdll.zip
- SHA256 2fee15f797ca4443cbfda12073902ce0bd5e8e270a2e779fb481a6d2ba382809
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
autoupdate.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
General
- Target taskdll.zip
- Size 1.9MB
- Sample240809-wt8g3stdrp
- SHA256 2fee15f797ca4443cbfda12073902ce0bd5e8e270a2e779fb481a6d2ba382809
- MD5 a9df6c7028b1a4bcd536da4f9256dbc9
- SHA1 bf97b5e31f4963c760a23f059787c3f3b49baf69
- SHA512 11907dd03380f099611e4e26eae6fbe71f9de4f5ce84182a87dadc635536beb80ec9a312ac64f6be3585c8758a6d4705f047ac9042d085c15a5fdd27219fa1cf
- SSDEEP 49152:rPPDBnmhPPEf33fHdV4lyAA6ucRzccGat2zdzMH:bVmhPsf33VVqyAA6uCccVABQH
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/autoupdate.dll
File Explorer
-
taskdll.zip.zip 1.9MB
-
SA.DAT6B
-
autoupdate.dll.dll 3.0MB
SA.DAT
- SHA256 12dc5ccd7fecafe070976a1916e9672e3d53085633c86957aee305ccc584184c
- MD5 f1a6cd5adaab953a6764ea364e17bfb8
- SHA1 c99a1eb2d8974a667d2e0bc2dc1efcbe0ef23387
- SHA512 da8cc20e0c0f48a975f97fc133ba4e99de6771163465d03f1cc0e3019fedfe0afa99799b9e343610a941218b19c9117b12e4ab86911d04c2908b6db44523e84c
- MD5 SHA1 SHA512
autoupdate.dll
- IMPHASH ebb54636871228f1f45ca81b8140ff5e
- SHA256 b57795017364deb0f319fa62c440500882562f6650e651b49058e080cbe8f9a8
- MD5 729527a4e620ce6650b35858f43f4f44
- SHA1 d01df5fd3edad753fdbbd3a15406f7b9e28e910e
- SHA512 c81ba619a3a74d2fa893b980ac11d2a49d8be2c42617f2cf0a65c04f26e1ae2a088bc2ce40d7c7171adace6e5d92d8eccac04fb6fafea6d9224fe79e1a70a108
- SSDEEP 49152:ciz0lsT/VMGu3M1AOhVZ1zY0tRJujI340tIsN69EdjXMPr4EClomXSK754zuBLZs:cqzuxk22fvXMTkoP9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
0
Entry point
1175261
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
gdi32
BRUSHOBJ_pvAllocRbrush
CreateFontIndirectExW
DeleteDC
EngFreeModule
EngLoadModule
GdiIsScreenDC
GdiResetDCEMF
GdiSetAttrs
GetAspectRatioFilterEx
GetCertificate
GetCharacterPlacementA
GetICMProfileW
GetTextExtentExPointA
MirrorRgn
PlayEnhMetaFileRecord
RemoveFontResourceA
RemoveFontResourceTracking
SelectObject
SetBrushAttributes
SetTextAlign
kernel32
CopyFileW
CreateDirectoryTransactedA
CreateFiberEx
CreateFileTransactedA
DisconnectNamedPipe
EnumResourceNamesW
FindFirstVolumeMountPointA
FindResourceW
FindVolumeClose
FoldStringW
FormatMessageW
GetActiveProcessorGroupCount
GetCalendarInfoA
GetCalendarWeekNumber
GetCommandLineA
GetConsoleCP
GetCurrencyFormatW
GetCurrentProcess
GetErrorMode
GetFileAttributesA
GetFileSizeEx
GetFileType
GetFullPathNameTransactedW
GetLogicalProcessorInformationEx
GetMaximumProcessorGroupCount
GetNumaProcessorNodeEx
GetProcAddress
GetThreadErrorMode
GetTickCount
GetUserGeoID
GlobalFlags
HeapCreate
HeapSummary
InterlockedPopEntrySList
IsBadStringPtrW
IsCalendarLeapMonth
LCMapStringA
LZCreateFileW
LoadLibraryA
OpenEventA
QueryDepthSList
ReOpenFile
ReadConsoleInputExW
SetConsoleInputExeNameW
SetConsoleMaximumWindowSize
SetConsoleTextAttribute
SetFileTime
SetMessageWaitingIndicator
SetThreadIdealProcessorEx
SetThreadpoolThreadMinimum
SetTimeZoneInformation
SetVDMCurrentDirectories
StartThreadpoolIo
TerminateProcess
VerLanguageNameA
WerUnregisterMemoryBlock
WriteFile
lstrcpyW
msvcrt
_ltoa
_pclose
_putenv
_spawnve
_strrev
_utime
_wpopen
clock
fclose
fopen
fputwc
free
fwprintf_s
getc
getchar
isalnum
iswalpha
iswpunct
malloc
memcpy
memset
swprintf
wcscpy
wscanf_s
shell32
ILIsEqual
ILIsParent
PathIsSlowA
SHBrowseForFolder
SHCreateDefaultExtractIcon
SHCreateDirectoryExA
SHGetPathFromIDList
SHLimitInputEdit
SHResolveLibrary
SHSetInstanceExplorer
SHSetTemporaryPropertyForItem
SHUpdateImageW
user32
AttachThreadInput
BuildReasonArray
ChangeMenuA
ChangeWindowMessageFilter
CharToOemBuffW
ClipCursor
DefMDIChildProcW
DestroyCaret
DrawFrameControl
EndPaint
EnumDesktopsW
GetCaretPos
GetClassInfoExW
GetClassLongPtrW
GetMenuCheckMarkDimensions
GetMenuState
GetPropW
GetTopWindow
GetWindowLongPtrA
GetWindowModuleFileNameA
IMPSetIMEA
IsCharUpperW
IsClipboardFormatAvailable
IsThreadDesktopComposited
LoadMenuIndirectW
LoadRemoteFonts
MB_GetString
PeekMessageA
PostMessageA
PostThreadMessageW
RegisterServicesProcess
ScrollChildren
SendMessageA
SendMessageCallbackW
SetDisplayConfig
SetMenuContextHelpId
SetTaskmanWindow
SetWindowPlacement
SoftModalMessageBox
TabbedTextOutA
TrackPopupMenu
UpdateWindow
Faulknerian_measurably_frizzier
MetternichWhigs
Nereid_racquets_lordship
airmailed_campaigned_bewailed
butches_pastiest
debilitatingMichelson
disaffected_centrist_moronic
fishier_yokel
flunksLouis_simulations
funeral_cosponsoring_get
haunt_host_perfectly
imprints_link
reigns_slipping_clashing
tangoed_modulate
tentacles_feasibly
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
466KB
Virtual Size
466KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
960KB
Virtual Size
960KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
1024B
Virtual Size
533B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ