Static task
static1
Behavioral task
behavioral1
Sample
49676c6ae76771a48914b205927818f931d301cdf87104c874b234f349d6ce91.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
49676c6ae76771a48914b205927818f931d301cdf87104c874b234f349d6ce91.dll
Resource
win10v2004-20240802-en
General
-
Target
49676c6ae76771a48914b205927818f931d301cdf87104c874b234f349d6ce91.dll
-
Size
490KB
-
MD5
322e3eb0984014882ee5ca1398f74805
-
SHA1
550f9ba5bd052dc7890f48f64ab3313eb171fbad
-
SHA256
49676c6ae76771a48914b205927818f931d301cdf87104c874b234f349d6ce91
-
SHA512
8169b4ba7444e97757dd17b65c4417ca990092c9eb37fe95c88ded23e920832055601e8560840b9a437acb002770475f062c89024495da356e8c77e5c8fbe528
-
SSDEEP
6144:dv2/Qv1XKasQKn6AvQlYGoMKQcIWG9hZEy4VbYTo6PBz/X3LWMCBN6AQ:dv2g1XKadfALGoMKQuqOePBTX7npAQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49676c6ae76771a48914b205927818f931d301cdf87104c874b234f349d6ce91.dll
Files
-
49676c6ae76771a48914b205927818f931d301cdf87104c874b234f349d6ce91.dll.dll windows:6 windows x86 arch:x86
1375420394a3775dca4e8d129dd830b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsAlloc
SuspendThread
ResumeThread
TlsSetValue
IsProcessorFeaturePresent
GetOverlappedResult
FindNextFileW
GetCPInfo
SetErrorMode
SetCommBreak
GetWindowsDirectoryA
GetLocaleInfoW
GetLastError
GetFileType
CreateEventW
GetDriveTypeW
EnumCalendarInfoW
GetUserDefaultLCID
GetTickCount
SizeofResource
GetSystemDefaultUILanguage
WideCharToMultiByte
LoadLibraryW
GetLocalTime
WinExec
GetWindowsDirectoryW
ExpandEnvironmentStringsW
TlsGetValue
GetEnvironmentStringsW
GetCurrentThread
GetSystemDirectoryA
DeleteCriticalSection
EnterCriticalSection
LoadLibraryA
EnumResourceTypesW
DeleteFileW
ReadConsoleW
WriteConsoleW
SetStdHandle
OutputDebugStringW
LoadLibraryExW
HeapReAlloc
SetFilePointerEx
ReadFile
GetConsoleMode
FlushFileBuffers
CloseHandle
GetModuleFileNameW
WriteFile
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetStdHandle
HeapSize
ExitProcess
IsDebuggerPresent
GetModuleFileNameA
QueryDosDeviceW
GetPrivateProfileIntW
SetThreadPriority
GetACP
CreateEventA
SetCommState
GetSystemTimeAsFileTime
GetLogicalDrives
GlobalLock
GetModuleHandleExW
HeapFree
SetFilePointer
SwitchToThread
FindFirstFileW
GetDiskFreeSpaceW
TlsFree
GetStartupInfoW
CreateFileW
MulDiv
GetFileAttributesW
GetExitCodeProcess
GetConsoleCP
ExpandEnvironmentStringsA
WaitForSingleObjectEx
CompareFileTime
SystemTimeToFileTime
GetEnvironmentVariableW
EncodePointer
GetCommandLineW
GetSystemTime
WritePrivateProfileStringW
UnmapViewOfFile
ExitThread
GetFullPathNameW
GetProcessHeap
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetProcAddress
DecodePointer
LeaveCriticalSection
MultiByteToWideChar
GetStringTypeW
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
GetModuleHandleW
user32
MessageBoxA
GetDlgItemTextW
CreateIconIndirect
CharLowerBuffW
DestroyCursor
MapWindowPoints
EndPaint
SetDlgItemTextW
GetWindow
DrawIconEx
AttachThreadInput
CreateDialogIndirectParamA
GetWindowLongW
MonitorFromWindow
GetSysColorBrush
EnableScrollBar
EndMenu
CheckMenuItem
CharUpperBuffW
IsIconic
GetSubMenu
GetDC
GetDesktopWindow
MessageBoxW
RegisterWindowMessageW
gdi32
CreatePolygonRgn
GetTextExtentPointW
RectInRegion
SetPolyFillMode
CreateHatchBrush
GetRgnBox
CreatePatternBrush
CloseEnhMetaFile
GetMetaFileBitsEx
ExtCreateRegion
GetCharABCWidthsW
GetNearestPaletteIndex
SetWindowOrgEx
advapi32
RegQueryInfoKeyW
ControlService
RegQueryValueExW
OpenSCManagerW
CloseServiceHandle
RegCloseKey
SetSecurityDescriptorDacl
RegOpenKeyExW
RegConnectRegistryW
StartServiceW
RegOpenKeyExA
RegDeleteKeyA
LookupPrivilegeValueW
SetSecurityDescriptorOwner
shell32
Shell_NotifyIconW
ExtractIconExW
ole32
CoTaskMemFree
oleaut32
SafeArrayGetLBound
VariantClear
SysReAllocStringLen
Sections
.text Size: 372KB - Virtual size: 371KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ