install_plregtry
Static task
static1
Behavioral task
behavioral1
Sample
3f328416b4bf952c12b7d80232d86b70N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3f328416b4bf952c12b7d80232d86b70N.dll
Resource
win10v2004-20240802-en
General
-
Target
3f328416b4bf952c12b7d80232d86b70N.exe
-
Size
21KB
-
MD5
3f328416b4bf952c12b7d80232d86b70
-
SHA1
e7ee77266975b2fc2a692dd732a87a97b4d34eae
-
SHA256
3b319f6c459d76056efe7783d2b0b353babb356df27df543d667659fd4323923
-
SHA512
9ac3054f2c461c527fde71fa7618ec0f987df2d55aa4117ebfaa40d1b8e4be57f9070d7f3dbaa51c36a328e0f3dc7f9fa2c408b46cac308f7abcd7bc5814966f
-
SSDEEP
384:dI3QVk9OiNzLCQONNGZ6vkucPqm7Ms9zTzb44g+OKuWu2+OLJPR7ccL3D:ubIiNzrOrGZEkXvR7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f328416b4bf952c12b7d80232d86b70N.exe
Files
-
3f328416b4bf952c12b7d80232d86b70N.exe.dll windows:4 windows x64 arch:x64
e98c30d15f9851cc63205914fbdfb894
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
GetLastError
InitializeCriticalSection
LeaveCriticalSection
LocalFree
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__iob_func
_amsg_exit
_assert
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
shell32
SHChangeNotify
libswipl
PL_atom_chars
PL_copy_term_ref
PL_domain_error
PL_get_arg_sz
PL_get_atom
PL_get_atom_chars
PL_get_int64
PL_get_integer
PL_get_list
PL_get_nil
PL_get_string
PL_instantiation_error
PL_is_functor
PL_is_integer
PL_new_atom
PL_new_functor_sz
PL_new_term_ref
PL_put_atom_chars
PL_raise_exception
PL_register_foreign
PL_term_type
PL_unify_atom_chars
PL_unify_integer
PL_unify_list
PL_unify_nil
PL_unify_term
Exports
Exports
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 432B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ