Static task
static1
Behavioral task
behavioral1
Sample
5df95d0adb1814d0f0730af2124b843ac515c04f09b6fa6ffcd21e6ff00657e3.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5df95d0adb1814d0f0730af2124b843ac515c04f09b6fa6ffcd21e6ff00657e3.dll
Resource
win10v2004-20241007-en
General
-
Target
5df95d0adb1814d0f0730af2124b843ac515c04f09b6fa6ffcd21e6ff00657e3
-
Size
2.1MB
-
MD5
458ee4e921b4e7e1a4b982e5d8b01df3
-
SHA1
da0291330b37c695bc6491a00d97f8b827d754ba
-
SHA256
5df95d0adb1814d0f0730af2124b843ac515c04f09b6fa6ffcd21e6ff00657e3
-
SHA512
764e7b30ff435c07e83a0437c45751931a5dce2fd861d4befb45722de89f12f2259e07262da5695c95b90bbe780f7c946db74c8c7d75c59ca25d68c8547be7d2
-
SSDEEP
49152:O1IS2htg965QOXIX/UzXwSlmoIIyfWyJBwfprx2Vqmhj63vbJAjmKWjQIZS:4+tVW0IPUzaWyJoqVBB63vbJeGQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5df95d0adb1814d0f0730af2124b843ac515c04f09b6fa6ffcd21e6ff00657e3
Files
-
5df95d0adb1814d0f0730af2124b843ac515c04f09b6fa6ffcd21e6ff00657e3.dll windows:6 windows x64 arch:x64
422217b03d24c15a1c98a605ebe1a20d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
WSACleanup
closesocket
select
getaddrinfo
WSAStartup
send
socket
connect
inet_ntoa
recv
getsockopt
freeaddrinfo
ioctlsocket
WSAGetLastError
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryA
MultiByteToWideChar
LoadLibraryW
GetProcAddress
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
ReadFile
GetModuleFileNameA
WriteFile
ExpandEnvironmentStringsA
SetFilePointer
CreateMutexW
CreateFileW
GetTickCount64
GetLastError
Process32NextW
CreateFileA
DisableThreadLibraryCalls
LoadLibraryA
Process32FirstW
WritePrivateProfileStringA
GetFileSize
FreeLibrary
GetPrivateProfileStringA
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
LocalFree
user32
TranslateMessage
ShowWindow
GetMessageW
DefWindowProcW
DestroyWindow
IsWindowVisible
CreateWindowExW
DispatchMessageW
RegisterClassW
SystemParametersInfoW
FindWindowW
SendMessageW
advapi32
RegCloseKey
RegCreateKeyA
RegQueryValueExA
shell32
ord190
ole32
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
oleaut32
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
msvcp140
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
_Query_perf_counter
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__std_type_info_compare
_CxxThrowException
memset
__std_exception_copy
__current_exception
__current_exception_context
__std_type_info_destroy_list
memmove
__C_specific_handler
memcpy
memcmp
memchr
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-filesystem-l1-1-0
rename
_access
remove
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
atoi
_itoa
atoll
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_initterm_e
_execute_onexit_table
_crt_atexit
_initterm
terminate
_cexit
_beginthread
_configure_narrow_argv
exit
api-ms-win-crt-string-l1-1-0
isalnum
isspace
isdigit
tolower
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-math-l1-1-0
roundf
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ