Static task
static1
Behavioral task
behavioral1
Sample
2f496835c2605d47f063ac269db5083b64f202398f59e7756554dbfcb3e0589a.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f496835c2605d47f063ac269db5083b64f202398f59e7756554dbfcb3e0589a.dll
Resource
win10v2004-20240802-en
General
-
Target
2f496835c2605d47f063ac269db5083b64f202398f59e7756554dbfcb3e0589a
-
Size
44KB
-
MD5
71b36fa49a946b56a7102cfab0753e2b
-
SHA1
b491f21b70891a212f4fb5c91ea0956e257af8c5
-
SHA256
2f496835c2605d47f063ac269db5083b64f202398f59e7756554dbfcb3e0589a
-
SHA512
3e5e3a8e5f6923019634d407a87573380fe8c53f848d635c1fd417edd8da0e6e42f82bf848c511b3aca6636fbdae64cf1be057c2cf75e95462affe1923038588
-
SSDEEP
384:IXCE4Mnx77flWjRpkt9ePEdx26/E1WicxgWPvf:IXCEnffUsoEKWjv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f496835c2605d47f063ac269db5083b64f202398f59e7756554dbfcb3e0589a
Files
-
2f496835c2605d47f063ac269db5083b64f202398f59e7756554dbfcb3e0589a.dll windows:4 windows x86 arch:x86
316fd511735177b2129f949a07c332f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
hidparse.sys
HidP_FreeCollectionDescription
HidP_GetButtonCaps
HidP_GetCaps
HidP_GetCollectionDescription
HidP_GetUsages
HidP_GetUsageValue
HidP_GetValueCaps
kernel32
GetModuleHandleW
GetProcAddress
GetTickCount
HeapAlloc
HeapReAlloc
IsBadStringPtrW
MulDiv
ntdll
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
_vsnprintf
ntoskrnl.exe
ObfReferenceObject
ExAllocatePool
ExFreePool
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IoCallDriver
IoCompleteRequest
IoCreateDevice
IoDeleteDevice
IoDetachDevice
IoInvalidateDeviceRelations
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
RtlInitUnicodeString
memcpy
wcscat
wcscpy
wcslen
wcsrchr
wcsstr
ucrtbase
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
free
fwrite
getenv
malloc
memcmp
memmove
strchr
strcmp
strcspn
strlen
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 160B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 603B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ