skarsnik
Static task
static1
Behavioral task
behavioral1
Sample
1bbd8ca2dc114ba924f957cdc95b5690N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1bbd8ca2dc114ba924f957cdc95b5690N.dll
Resource
win10v2004-20240802-en
General
-
Target
1bbd8ca2dc114ba924f957cdc95b5690N.exe
-
Size
1.4MB
-
MD5
1bbd8ca2dc114ba924f957cdc95b5690
-
SHA1
aa864474019d6ce0d3f5f65479b61b65cdf372ad
-
SHA256
27aaf86065da7ebad5af476c79298d043749dcf1ac2520e4ffe35fdd7186bae4
-
SHA512
2eca3db75e2e3070b547817f565e60e38e9752c0ff0ca1906628ae734971adda98333903166f9443f13e39766d07f671d325d8fd4c1eaf5fdcb98db82521afa3
-
SSDEEP
24576:AlFQK8118xs92NZDk3cyoYVpG26NPTbCQGbKs:AlFQK811x2NZDJYVONPTbs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bbd8ca2dc114ba924f957cdc95b5690N.exe
Files
-
1bbd8ca2dc114ba924f957cdc95b5690N.exe.dll windows:5 windows x64 arch:x64
d4eaf0c572c8091b91a75a0a10886a58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
ntohl
htonl
htons
getsockopt
connect
freeaddrinfo
getaddrinfo
WSAGetLastError
setsockopt
WSASocketW
WSASend
WSARecv
select
ioctlsocket
closesocket
WSACleanup
WSAStartup
WSASetLastError
ntohs
kernel32
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
LoadLibraryW
Sleep
FreeLibraryAndExitThread
GetProcAddress
GetCurrentThreadId
CreateThread
GetModuleHandleExW
OpenProcess
GetCurrentProcessId
GetModuleFileNameW
GetNativeSystemInfo
IsWow64Process
QueryInformationJobObject
GetLastError
CloseHandle
GetCurrentProcess
GetModuleHandleW
SetThreadPriority
CreateFileW
ReadFile
GetExitCodeThread
WaitForSingleObject
OpenEventW
CreateEventW
SetEvent
ResetEvent
FreeLibrary
GetSystemTimeAsFileTime
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
QueueUserAPC
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
SetLastError
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
HeapAlloc
RaiseException
DecodePointer
FileTimeToSystemTime
VirtualQuery
VirtualFree
InitializeSListHead
GetModuleHandleA
GetThreadTimes
OutputDebugStringW
WriteConsoleW
SetStdHandle
FlushFileBuffers
FormatMessageA
OpenEventA
GetCurrentThread
IsValidCodePage
TerminateThread
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetStdHandle
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
HeapFree
IsProcessorFeaturePresent
GetCommandLineA
GetCPInfo
ExitThread
LoadLibraryExW
IsDebuggerPresent
ExitProcess
AreFileApisANSI
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetACP
user32
GetWindowTextW
SendMessageTimeoutW
SetActiveWindow
EnumWindows
GetClassNameW
BringWindowToTop
advapi32
RegCloseKey
RegOpenKeyExW
Exports
Exports
Sections
.text Size: 934KB - Virtual size: 956KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 393KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ