AlsntlheRrtotdabsq
Static task
static1
Behavioral task
behavioral1
Sample
d0cb9ba24bc2a2bba1740db372ba5e40N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d0cb9ba24bc2a2bba1740db372ba5e40N.dll
Resource
win10v2004-20240802-en
General
-
Target
d0cb9ba24bc2a2bba1740db372ba5e40N.exe
-
Size
2.8MB
-
MD5
d0cb9ba24bc2a2bba1740db372ba5e40
-
SHA1
8941196cf07dc5aa50a9cc3f560f63ca09cb9e15
-
SHA256
a6be9c6ccebee13fbcadc166e026019450f057ac8b3859012a4eed147e3c47d0
-
SHA512
1e61955eb47c23841d974be4d8c0e5cfe9d0468f6720a608642b995cce72def3ef4cf0aa330e20716dbae013820416453ff7c06be9a264bcdbcccbc2179c0c8a
-
SSDEEP
49152:SNIyW1KhqFxTEhbGX+I2LHTXF8+O2mbD7Z++Cf30LRkveBrTaXgAh8qOei5SSN3:SGuphbgAr2XbY7KKg+Pq5p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0cb9ba24bc2a2bba1740db372ba5e40N.exe
Files
-
d0cb9ba24bc2a2bba1740db372ba5e40N.exe.dll windows:5 windows x86 arch:x86
5c9d6a4db800494e164e7c57cc68cc67
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ole32
OleTranslateAccelerator
winmm
waveOutGetPlaybackRate
joyGetPosEx
lz32
GetExpandedNameW
esent
JetInit
rpcrt4
RpcServerUseProtseqA
I_RpcServerSetAddressChangeFn
I_RpcNegotiateTransferSyntax
RpcStringBindingParseW
I_RpcTurnOnEEInfoPropagation
winspool.drv
AddFormW
DeletePrinterDriverW
SetPortW
urlmon
UrlMkSetSessionOption
oleaut32
VARIANT_UserFree
VarR8FromUI1
GetErrorInfo
LoadTypeLibEx
wininet
HttpOpenRequestA
comdlg32
FindTextW
setupapi
SetupDiEnumDeviceInfo
shell32
ShellExecuteW
SHCreateShellItem
SHGetFolderPathA
SHAppBarMessage
SHBrowseForFolderA
shlwapi
StrRChrA
UrlUnescapeA
StrStrW
crypt32
CryptSIPCreateIndirectData
advapi32
LookupPrivilegeValueW
CryptGenKey
AccessCheckAndAuditAlarmW
CryptEncrypt
SaferComputeTokenFromLevel
GetAclInformation
RegCloseKey
rasapi32
RasGetProjectionInfoA
RasFreeEapUserIdentityA
RasGetCustomAuthDataW
gdi32
PlayMetaFile
PtVisible
GetClipRgn
EnumFontFamiliesExA
SetEnhMetaFileBits
comctl32
ImageList_Create
ImageList_LoadImageA
secur32
VerifySignature
AcceptSecurityContext
winscard
SCardStatusA
SCardTransmit
SCardGetCardTypeProviderNameW
SCardGetProviderIdA
ws2_32
select
user32
ShowScrollBar
GetSystemMetrics
CreateCaret
ShowWindow
DialogBoxIndirectParamW
UpdateWindow
OpenClipboard
SetWindowContextHelpId
CopyAcceleratorTableA
DialogBoxParamW
GetMessageW
PostQuitMessage
wintrust
CryptCATAdminCalcHashFromFileHandle
CryptCATStoreFromHandle
kernel32
CloseHandle
HeapSize
GetTimeZoneInformation
SetFilePointer
FlushFileBuffers
GetCommandLineA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
WriteConsoleA
WriteFile
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetStdHandle
FreeEnvironmentStringsA
GetACP
GetOEMCP
CompareStringA
SetEnvironmentVariableA
HeapReAlloc
HeapAlloc
IsValidLocale
EnumSystemLocalesA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetModuleFileNameA
GetCurrentProcessId
IsValidCodePage
QueryPerformanceCounter
LoadLibraryA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
RtlUnwind
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
FatalAppExitA
ExitProcess
HeapFree
Sleep
CompareStringW
GetCurrentThread
GetLastError
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
WaitForSingleObjectEx
Process32FirstW
FreeResource
AddAtomA
WaitCommEvent
InterlockedDecrement
DeleteCriticalSection
SetEvent
VerSetConditionMask
LeaveCriticalSection
WaitForSingleObject
GetModuleFileNameW
GetBinaryTypeW
GetCommProperties
GetProcessShutdownParameters
ClearCommBreak
GetSystemDefaultLCID
LoadLibraryExA
LoadLibraryW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
InterlockedIncrement
GetModuleHandleW
mprapi
MprAdminMIBEntryGetFirst
Exports
Exports
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.erloc Size: 920KB - Virtual size: 917KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ