OoItsndxha
Static task
static1
Behavioral task
behavioral1
Sample
a7f8d522b8a0618f286b9ff09097880589b364fec8be21789637cebeb5832447.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a7f8d522b8a0618f286b9ff09097880589b364fec8be21789637cebeb5832447.dll
Resource
win10v2004-20240802-en
General
-
Target
856d6d6096b874f5d0cf46b2e74fc1af.bin
-
Size
1.5MB
-
MD5
27cd42aacfc4f53db4bf24c4bc72be42
-
SHA1
b94e6c69538b740931f10039712749c96a2bfa14
-
SHA256
26c7a4b28daeeb16a2444f387db015c39bb45364d73a4f4a58f245897e9e1161
-
SHA512
76923e7f227b0133fc06f458d2160c9139823e6a383417e9976ff71b954b72609a4b96347e667fbacd90a17928fbe3753ff832d3dd76d2851427f3f280b70a46
-
SSDEEP
24576:dJNrZ/M/A0X6ZtmKiY7oN+VYB4lpZoXMoSK4NXdk40VR4vo1Tpm9y9Nu/b7g9hwf:dJZNqbEJiY7JVYBOpZoPH4VSbV2+Tpdc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/a7f8d522b8a0618f286b9ff09097880589b364fec8be21789637cebeb5832447.dll
Files
-
856d6d6096b874f5d0cf46b2e74fc1af.bin.zip
Password: infected
-
a7f8d522b8a0618f286b9ff09097880589b364fec8be21789637cebeb5832447.dll.dll windows:5 windows x86 arch:x86
Password: infected
79119896469024f539c528df6c348183
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
rpcrt4
RpcServerUseProtseqEpExW
psapi
GetModuleFileNameExW
lz32
GetExpandedNameW
kernel32
VirtualAlloc
GetFileSize
GetLargestConsoleWindowSize
CancelWaitableTimer
LoadLibraryExA
LoadLibraryA
GetModuleFileNameA
user32
MonitorFromRect
IsWindowVisible
GetClipboardOwner
ActivateKeyboardLayout
RegisterShellHookWindow
iphlpapi
CancelIPChangeNotify
advapi32
CryptEnumProviderTypesW
gdi32
StrokeAndFillPath
SetViewportOrgEx
comctl32
ImageList_GetIcon
Exports
Exports
Sections
.text Size: 368KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
hxBVr4KZ Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1008B
IMAGE_SCN_MEM_READ
.reloc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ