ReflectiveLoader
Static task
static1
Behavioral task
behavioral1
Sample
473b355e7ed62967b5f94c43cf4516876d61369e77c18c4474310e0cb7bdf55b.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
473b355e7ed62967b5f94c43cf4516876d61369e77c18c4474310e0cb7bdf55b.dll
Resource
win10v2004-20240802-en
General
-
Target
473b355e7ed62967b5f94c43cf4516876d61369e77c18c4474310e0cb7bdf55b.zip
-
Size
161KB
-
MD5
f4cde0880a5fdcc34bc9162420f7fad8
-
SHA1
bc1e568123fe81c29f56f1aeae69263d9b2755cc
-
SHA256
4de5f93132cdd8a020e82e70752ce08ca74fa5dbfc7647992ab7a97fb0dc743c
-
SHA512
84793cffc04f6ea9c2e53299b62b7fa15d852203669d3366d002de1a26457ee3bb54834709c190de71651bd449e9422b54caddaf5aa866d5c4075cf60be95f8e
-
SSDEEP
3072:feZYxqk7zQdKzVN7KPvtqKndxNeOO/c3/awnEMK9F71maeiEK:AI57OntqWdxN5OktnEd9n4y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/473b355e7ed62967b5f94c43cf4516876d61369e77c18c4474310e0cb7bdf55b
Files
-
473b355e7ed62967b5f94c43cf4516876d61369e77c18c4474310e0cb7bdf55b.zip.zip
Password: infected
-
473b355e7ed62967b5f94c43cf4516876d61369e77c18c4474310e0cb7bdf55b.dll windows:5 windows x64 arch:x64
Password: infected
46551b97c1d63fc258acfca97bdbeb94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CreateNamedPipeA
TerminateProcess
CreateProcessA
GetCurrentDirectoryW
GetFullPathNameA
GetLogicalDrives
FindClose
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExpandEnvironmentStringsA
GetFileAttributesA
FindFirstFileA
FindNextFileA
CopyFileA
MoveFileA
GetCurrentProcessId
CreateThread
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Wow64GetThreadContext
Wow64SetThreadContext
VirtualAlloc
VirtualProtect
SetLastError
SetNamedPipeHandleState
PeekNamedPipe
CreateFileA
WaitNamedPipeA
GetModuleFileNameA
GetComputerNameA
GetVersionExA
GetACP
GetOEMCP
GetProcessHeap
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
SetErrorMode
UpdateProcThreadAttribute
ProcessIdToSessionId
Process32First
Process32Next
GetComputerNameExA
VirtualFree
VirtualQuery
VirtualAllocEx
VirtualProtectEx
OpenProcess
CreateRemoteThread
ConnectNamedPipe
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
ResumeThread
CloseHandle
DuplicateHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ExitProcess
ExitThread
ReadFile
GetCurrentThread
GetCurrentProcess
MultiByteToWideChar
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
DisconnectNamedPipe
CreatePipe
GetTickCount
GetLocalTime
FlushFileBuffers
WriteFile
WaitForSingleObject
Sleep
GetModuleHandleA
LoadLibraryA
GetLastError
HeapFree
RaiseException
SetEnvironmentVariableW
SetEnvironmentVariableA
HeapAlloc
HeapDestroy
HeapCreate
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
HeapSize
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
GetFileType
SetFilePointerEx
SetFilePointer
ReadConsoleW
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetCPInfo
IsValidCodePage
RtlUnwindEx
GetProcAddress
OpenThread
FreeLibrary
EncodePointer
DecodePointer
GetModuleHandleExW
AreFileApisANSI
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
advapi32
GetTokenInformation
OpenProcessToken
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
CheckTokenMembership
DuplicateTokenEx
LogonUserA
LookupAccountSidA
FreeSid
AllocateAndInitializeSid
ImpersonateNamedPipeClient
RevertToSelf
GetUserNameA
CreateProcessWithTokenW
CreateProcessWithLogonW
CreateProcessAsUserA
ImpersonateLoggedOnUser
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenThreadToken
wininet
InternetReadFile
InternetCloseHandle
InternetConnectA
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
InternetSetStatusCallback
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpQueryInfoA
InternetOpenA
ws2_32
ntohs
gethostbyname
socket
send
connect
ioctlsocket
WSAIoctl
WSACleanup
WSAStartup
closesocket
ntohl
htons
htonl
recv
shutdown
WSAGetLastError
__WSAFDIsSet
accept
bind
inet_addr
listen
recvfrom
select
sendto
WSASocketA
Exports
Exports
Sections
.text Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ