image.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4fee8bd9e8cc54042ab138baf9d53803df0dbdcbf0b8dd28466b57fc298a7f67N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4fee8bd9e8cc54042ab138baf9d53803df0dbdcbf0b8dd28466b57fc298a7f67N.dll
Resource
win10v2004-20240802-en
General
-
Target
4fee8bd9e8cc54042ab138baf9d53803df0dbdcbf0b8dd28466b57fc298a7f67N
-
Size
735KB
-
MD5
26154f3ec4934b30e5d9fa46ddee6e10
-
SHA1
97fa903651ae75acf374028647e14c8fc9d4fa90
-
SHA256
4fee8bd9e8cc54042ab138baf9d53803df0dbdcbf0b8dd28466b57fc298a7f67
-
SHA512
20705df81d2c52f5f9c4ab340689f0000264af8b688ad78c3af77450b9b77b8c4a24a291af36260a4a3da9fa5c24f44970822aac26868e93f07f125c6443cbfb
-
SSDEEP
12288:aBPJtiww6rXjpi2wpiWy+k/6SArrIcdO:aBPj5rXjpbwsnyO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4fee8bd9e8cc54042ab138baf9d53803df0dbdcbf0b8dd28466b57fc298a7f67N
Files
-
4fee8bd9e8cc54042ab138baf9d53803df0dbdcbf0b8dd28466b57fc298a7f67N.dll windows:6 windows x64 arch:x64
533958a9f87ee8c43bd5c5393e992f3b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
gdi32
DeleteDC
GetDIBits
CreateCompatibleDC
SelectObject
DeleteObject
winamp
ord795
ord1008
ord1023
ord1096
ord1094
ord1095
ord541
ord1045
ord1090
ord1049
ord1073
ord1091
ord1055
ord1092
ord1057
ord1089
ord1282
ord1050
ord1290
ord1286
ord1176
ord444
ord1137
ord445
ord524
ord286
ord571
ord600
ord807
ord801
ord804
ord800
ord805
ord803
ord806
ord808
ord799
ord159
vcruntime140
__intrinsic_setjmp
memset
__std_type_info_destroy_list
longjmp
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
raise
_initterm
_initterm_e
_cexit
_execute_onexit_table
_beginthreadex
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
kernel32
LoadLibraryExA
GetProcAddress
FreeLibrary
VirtualQuery
VirtualProtect
GetSystemInfo
GetLastError
RaiseException
EnterCriticalSection
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DeleteCriticalSection
CloseHandle
WaitForSingleObjectEx
InitializeCriticalSectionEx
InitializeConditionVariable
LeaveCriticalSection
SetThreadPriority
WakeConditionVariable
SleepConditionVariableCS
Exports
Exports
GetWACUPComponent
Sections
.text Size: 583KB - Virtual size: 583KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ