Static task
static1
Behavioral task
behavioral1
Sample
46bfa9ce673bead846d7d993437d9d90N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
46bfa9ce673bead846d7d993437d9d90N.dll
Resource
win10v2004-20240802-en
General
-
Target
46bfa9ce673bead846d7d993437d9d90N
-
Size
5.3MB
-
MD5
46bfa9ce673bead846d7d993437d9d90
-
SHA1
4fa0f7310dac8c13b32095af06e6ac23876b0b0f
-
SHA256
dfd148c87f0c484c854013487942c31457fb9030515a0cb2754e30f2823ebfe9
-
SHA512
e9e65da6135dbf1e357169059bcaf1c89ce97ef39054334ac03e4dbdc7803c8c790327938cf517925b7cc9a2400201786879b8d3722e3ca2da8e3044b1317b08
-
SSDEEP
98304:1dnGnN6BkRlAFlAk9+rZlG7O5Akj5tywaH:1FGNTRlSAkgrn4fkj5twH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46bfa9ce673bead846d7d993437d9d90N
Files
-
46bfa9ce673bead846d7d993437d9d90N.dll windows:6 windows x64 arch:x64
6b9edaa2e274c9e2b35e029ea32d33cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateDirectoryW
WriteProcessMemory
WriteFile
VirtualAlloc
CreateFileW
DuplicateHandle
CreateToolhelp32Snapshot
CreateEventW
Sleep
Process32NextW
SetEvent
LoadLibraryA
CreateThreadpoolWait
Process32FirstW
GetProcAddress
GetProcessHeap
GetModuleHandleW
VirtualProtect
SetLastError
VirtualFree
GetNativeSystemInfo
FreeLibrary
IsBadReadPtr
WaitForSingleObject
CreateThread
VirtualFreeEx
SetEndOfFile
WriteConsoleW
GetCurrentProcessId
LocalFree
HeapAlloc
CloseHandle
GetLastError
OpenProcess
GetVersionExW
LocalAlloc
GetModuleFileNameW
lstrlenW
GetCurrentProcess
VirtualAllocEx
HeapFree
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
user32
MessageBoxA
advapi32
RegCloseKey
RegCreateKeyExW
RegSetValueExW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
LookupAccountSidW
GetTokenInformation
shell32
ShellExecuteW
SHGetKnownFolderPath
ole32
CoTaskMemFree
oleaut32
SysAllocString
SysStringLen
SysFreeString
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryObject
RtlCaptureContext
NtQueryInformationProcess
wininet
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
rstrtmgr
RmShutdown
RmEndSession
RmStartSession
RmGetList
RmRegisterResources
Sections
.text Size: 183KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ