RMACreateInstance
Static task
static1
Behavioral task
behavioral1
Sample
c8e0cfa1e3bfbaa28f206f54a0d8b6fe8fc6da36f0ea68a051b8e7142aec5c1cN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c8e0cfa1e3bfbaa28f206f54a0d8b6fe8fc6da36f0ea68a051b8e7142aec5c1cN.dll
Resource
win10v2004-20240802-en
General
-
Target
c8e0cfa1e3bfbaa28f206f54a0d8b6fe8fc6da36f0ea68a051b8e7142aec5c1cN
-
Size
276KB
-
MD5
e831066bbade3e56f3036ecbc45161c0
-
SHA1
67aeef44a41b8a4f1812f796ae4513e8472879be
-
SHA256
c8e0cfa1e3bfbaa28f206f54a0d8b6fe8fc6da36f0ea68a051b8e7142aec5c1c
-
SHA512
1416839d343cf9ea8fe852c1dfb32335c2fbef09ea82407ed28cbc94b29c748f54a7e861c8775d856c55d618bea8cef07063dba1f6221070fc3767914ac1ee14
-
SSDEEP
6144:BRWxXsMwYLZTcDOtlIksZx7bTmCul+ZlndPNyfxWVWQfdTL4h0tezB3LtGKl7FDR:BRgXsMwYLZTcDOtl3sZx7bTm/l+Zlndh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8e0cfa1e3bfbaa28f206f54a0d8b6fe8fc6da36f0ea68a051b8e7142aec5c1cN
Files
-
c8e0cfa1e3bfbaa28f206f54a0d8b6fe8fc6da36f0ea68a051b8e7142aec5c1cN.dll windows:4 windows x86 arch:x86
aa9ada853ab8b69248e96fb87b67d5f7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
pncrt
strstr
sprintf
free
__CxxFrameHandler
_errno
_open
_close
_lseek
_read
_write
memmove
_fstat
_chsize
strchr
_strnicmp
isspace
strrchr
atof
strtol
??2@YAPAXI@Z
realloc
_timezone
localtime
_tzset
strtod
_initterm
_adjust_fdiv
__dllonexit
_onexit
qsort
time
_vsnprintf
malloc
_ftol
atoi
vsprintf
_stricmp
strncmp
_purecall
??3@YAXPAX@Z
strncpy
_creat
_tell
_sopen
_ftime
_strcmpi
_unlink
ole32
CoCreateGuid
kernel32
GetTempPathA
GetTempFileNameA
CloseHandle
CreateFileA
CreateFileMappingA
MapViewOfFile
GetLastError
UnmapViewOfFile
GetSystemInfo
GetFileSize
GlobalMemoryStatus
GetTickCount
DisableThreadLibraryCalls
Exports
Exports
Sections
.text Size: 232KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE