Static task
static1
Behavioral task
behavioral1
Sample
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
Resource
win10v2004-20240802-en
General
-
Target
361382566ad122e573670c57fbe1411e.bin
-
Size
2.7MB
-
MD5
edffa7af8856fe802bc64b7d2b47c4f2
-
SHA1
b50ea5661643ad544ba09847c213904a5694c9ce
-
SHA256
70780280ed7ab9d15e2f30938105ab59d4dd8ad2466004ffdb346aab0593dfad
-
SHA512
9ecc34cca0593e04a9768cbee4f949d05dd00d7d33b1c362e35b65a38c41ad9bbda7a7f6ab1f18d909cb1336aaa23bdc9dae79d84f6d39b94071eb6739443751
-
SSDEEP
49152:Vr3cbvU8Tbax4ORz3hcXL7SLmBSnxa1J4eFaVeQgGUk:V7cb8gJO3cXXSLKSxaXXFYZ/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll
Files
-
361382566ad122e573670c57fbe1411e.bin.zip
Password: infected
-
5b8043e178373d4b732c6bf1013173b9f9a1f30269996392da367547d6a4a70f.dll.dll windows:5 windows x86 arch:x86
Password: infected
624199252d90037098e031b272a447e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdsapi
DsReplicaGetInfo2W
user32
GetMessagePos
SetMenu
ReleaseDC
GetMenu
SwitchDesktop
GetFocus
imm32
ImmGetContext
advapi32
GetNamedSecurityInfoW
winmm
midiOutLongMsg
oleaut32
SafeArrayDestroyData
msvcrt
tolower
wintrust
CryptCATEnumerateAttr
CryptCATPutMemberInfo
crypt32
CertSetCertificateContextProperty
shlwapi
PathQuoteSpacesW
PathFindOnPathW
iphlpapi
GetTcpStatisticsEx
rasapi32
RasGetErrorStringW
shell32
SHGetInstanceExplorer
gdi32
GdiFlush
kernel32
OutputDebugStringA
LoadLibraryExW
CloseHandle
GetCompressedFileSizeW
DeleteTimerQueueEx
OpenEventA
GetFileTime
LockResource
secur32
InitializeSecurityContextW
TranslateNameW
ole32
OleLockRunning
HWND_UserMarshal
setupapi
SetupDiDrawMiniIcon
CMP_WaitNoPendingInstallEvents
wininet
InternetSetOptionA
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qdata Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ