Static task
static1
Behavioral task
behavioral1
Sample
009ab5b2d399d19d376b71cd1e155890N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
009ab5b2d399d19d376b71cd1e155890N.dll
Resource
win10v2004-20240802-en
General
-
Target
009ab5b2d399d19d376b71cd1e155890N.exe
-
Size
257KB
-
MD5
009ab5b2d399d19d376b71cd1e155890
-
SHA1
0c4391c8758e55e60a067a959d67b932e84113b8
-
SHA256
1ef16f416958f1400400e3855b71aca048c676e684903700fd7436bb82898400
-
SHA512
676d2087571b062ea85b41029d60027596aa2f6d9e0525bfd917da1d1f77e13c760381c199a352280f4e44c57aae90491ac2b47e2600af065feb8fbf24e1b8f4
-
SSDEEP
6144:B277f5Dl/9fUYqGx4L+OQeeaQeeUQeesQeeGvQeehQeeVUkAWV9llyMCssROWMV:BAVZ9fUYqcZkv4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 009ab5b2d399d19d376b71cd1e155890N.exe
Files
-
009ab5b2d399d19d376b71cd1e155890N.exe.dll windows:5 windows x86 arch:x86
cdcc477855a0dd31c60575297b1134fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DisableThreadLibraryCalls
CreateThread
Sleep
GetModuleHandleA
VirtualAlloc
VirtualProtect
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
GetSystemInfo
IsProcessorFeaturePresent
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
GetProcAddress
OutputDebugStringA
user32
GetAsyncKeyState
GetSystemMetrics
DestroyWindow
ShowWindow
CreateWindowExA
SetRect
gdi32
GetGlyphOutlineA
SetBkMode
GetTextMetricsW
GetTextMetricsA
GetObjectW
GetCharacterPlacementW
GetCharacterPlacementA
SetTextAlign
ExtTextOutW
MoveToEx
CreateFontIndirectW
DeleteDC
DeleteObject
ExtTextOutA
GetObjectA
SetBkColor
SetTextColor
SelectObject
SetMapMode
CreateDIBSection
CreateCompatibleDC
CreateFontIndirectA
GetFontLanguageInfo
msvcr90
iswdigit
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
sprintf
??_U@YAPAXI@Z
free
??2@YAPAXI@Z
memcpy
memset
malloc
_CIacos
_finite
_ftol
??3@YAXPAX@Z
strncpy
__CxxFrameHandler
iswpunct
iswalpha
iswspace
d3d9
Direct3DCreate9
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
Sections
_TEXT Size: 512B - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ