Qszdez
Static task
static1
Behavioral task
behavioral1
Sample
85d34d81c9c89b371abac1d231998af217c6a865fa37ecc6bfc3b3341ec2f04f.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
85d34d81c9c89b371abac1d231998af217c6a865fa37ecc6bfc3b3341ec2f04f.dll
Resource
win10v2004-20240802-en
General
-
Target
85d34d81c9c89b371abac1d231998af217c6a865fa37ecc6bfc3b3341ec2f04f
-
Size
368KB
-
MD5
66c8af256eccd2d7c01f656267f2a7c3
-
SHA1
d630e6e28c48710cce5a758bc1bb9e7b8fe83299
-
SHA256
85d34d81c9c89b371abac1d231998af217c6a865fa37ecc6bfc3b3341ec2f04f
-
SHA512
3781ae1a123a64e34425bdeced8e65635c54f68d450146cccd152817da43bc3391028bae5268f0e27aa79b890a81e7b9534439751b9a16ff1674389767c0eb36
-
SSDEEP
768:H7h8rbOGO7l1/AikjTzeZoPy/E5LBab625xEkz4ki8jjPeco9du/4S7:bGrbWjajTzeZoPy/kBK+k7imxoDugS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85d34d81c9c89b371abac1d231998af217c6a865fa37ecc6bfc3b3341ec2f04f
Files
-
85d34d81c9c89b371abac1d231998af217c6a865fa37ecc6bfc3b3341ec2f04f.dll windows:4 windows x86 arch:x86
8f1e976a269edb3d3087608a9b1f23e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
CloseHandle
CreateThread
WriteFile
WideCharToMultiByte
GetOEMCP
GetVersionExW
GetComputerNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
ReadFile
PeekNamedPipe
MultiByteToWideChar
CreateProcessW
CreatePipe
CompareStringW
CompareStringA
RtlUnwind
LCMapStringW
LCMapStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetProcAddress
GetACP
SetFilePointer
CreateFileW
InterlockedDecrement
InterlockedIncrement
GetLastError
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapFree
HeapAlloc
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
GetCPInfo
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
SetEnvironmentVariableA
shell32
ShellExecuteW
ws2_32
gethostbyname
inet_ntoa
WSACleanup
WSAStartup
gethostname
wininet
InternetCloseHandle
InternetOpenA
HttpSendRequestW
InternetReadFile
HttpOpenRequestA
InternetConnectA
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.shell Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ