Static task
static1
Behavioral task
behavioral1
Sample
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
Resource
win10v2004-20240802-en
General
-
Target
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
-
Size
3.0MB
-
MD5
361382566ad122e573670c57fbe1411e
-
SHA1
0a6c2fa6ff9b9b10890ea6c299aa19f91cc402a3
-
SHA256
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f
-
SHA512
968d937dbeb753df098be3dbc56f56beb425ac5b78cc8017366c40522e6423b77c44cb5505e08308e5c936320d1206bf5f94acbe55dee6a496020790cbc4cf53
-
SSDEEP
49152:dKNtZSDdh/QuoFNjdKLhdvgFiTyixsa9sXlO+pP0BfmhaU/08YOx68YPMbhFI3W:dKNtEDdRQzNjdK1dY0z9d+pP0sr08YGw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
Files
-
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll.dll windows:5 windows x86 arch:x86
624199252d90037098e031b272a447e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdsapi
DsReplicaGetInfo2W
user32
GetMessagePos
SetMenu
ReleaseDC
GetMenu
SwitchDesktop
GetFocus
imm32
ImmGetContext
advapi32
GetNamedSecurityInfoW
winmm
midiOutLongMsg
oleaut32
SafeArrayDestroyData
msvcrt
tolower
wintrust
CryptCATEnumerateAttr
CryptCATPutMemberInfo
crypt32
CertSetCertificateContextProperty
shlwapi
PathQuoteSpacesW
PathFindOnPathW
iphlpapi
GetTcpStatisticsEx
rasapi32
RasGetErrorStringW
shell32
SHGetInstanceExplorer
gdi32
GdiFlush
kernel32
OutputDebugStringA
LoadLibraryExW
CloseHandle
GetCompressedFileSizeW
DeleteTimerQueueEx
OpenEventA
GetFileTime
LockResource
secur32
InitializeSecurityContextW
TranslateNameW
ole32
OleLockRunning
HWND_UserMarshal
setupapi
SetupDiDrawMiniIcon
CMP_WaitNoPendingInstallEvents
wininet
InternetSetOptionA
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qdata Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ