Static task
static1
Behavioral task
behavioral1
Sample
ec5b8ef24dd290ce5601e30e22c2ec155f63877eba4e744d892bf61ebfb4945eN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec5b8ef24dd290ce5601e30e22c2ec155f63877eba4e744d892bf61ebfb4945eN.dll
Resource
win10v2004-20241007-en
General
-
Target
ec5b8ef24dd290ce5601e30e22c2ec155f63877eba4e744d892bf61ebfb4945eN
-
Size
40KB
-
MD5
202fd7770b8de28819e6ec8eee18acf0
-
SHA1
db5de972e1d6f2a6c1568f030375149762bbcd8a
-
SHA256
ec5b8ef24dd290ce5601e30e22c2ec155f63877eba4e744d892bf61ebfb4945e
-
SHA512
3893b4de7e76b7520fd414015824b323c7f71ba915108d199812c28975df3d995dc32494aff625be75c52bf3f8c094b7860f7c0d3154a417ca5259f056135279
-
SSDEEP
384:nCBOExedBDVtmUjWrZuDekC0Qm1r8hAgyHJHnyIxY7f9pDDBls:nT2Uao20Qm5jDm7LPg
Malware Config
Signatures
Files
-
ec5b8ef24dd290ce5601e30e22c2ec155f63877eba4e744d892bf61ebfb4945eN.dll windows:4 windows x86 arch:x86
3bda43f07a3554b0c4e81ef13978c802
Code Sign
86:2b:d6:06:56:6a:96:4f:ab:8a:f3:ce:b1:af:deCertificate
IssuerCN=Root AgencyNot Before13/02/2010, 07:08Not After31/12/2039, 23:59SubjectCN=Micrcnsoft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapDestroy
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GetTickCount
InterlockedDecrement
GetModuleFileNameW
Sleep
GetSystemDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetShortPathNameW
lstrcpynW
lstrcpynA
GetVersionExW
LoadLibraryW
GetProcAddress
EnterCriticalSection
GetCurrentThreadId
lstrlenW
LeaveCriticalSection
user32
GetMenuItemInfoW
AppendMenuW
GetMenuItemCount
CreatePopupMenu
TrackPopupMenuEx
DestroyMenu
MonitorFromPoint
IsWindow
MapWindowPoints
PtInRect
GetClientRect
GetMonitorInfoW
MessageBeep
SetFocus
PostQuitMessage
LoadStringA
CallWindowProcW
GetWindowLongW
GetTopWindow
DispatchMessageW
TranslateMessage
GetMessageW
RemoveMenu
InvalidateRect
GetParent
GetClassNameW
GetWindow
SendMessageW
GetWindowTextW
GetCursorPos
GetWindowRect
SetCursorPos
mouse_event
KillTimer
PostMessageW
SetTimer
GetLastInputInfo
DefWindowProcW
TranslateAcceleratorW
GetClassInfoExW
LoadCursorW
wsprintfW
LoadImageW
RegisterClassExW
SetWindowLongW
CreateWindowExW
LoadStringW
LoadMenuW
LoadAcceleratorsW
DestroyWindow
PeekMessageW
SetWindowPos
shell32
ShellExecuteW
advapi32
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegCloseKey
RegCreateKeyExW
ole32
OleUninitialize
OleInitialize
msvcp60
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Xlen@std@@YAXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
msvcrt
__CxxFrameHandler
free
realloc
_initterm
memmove
??2@YAPAXI@Z
_purecall
wcscpy
wcsstr
wcscat
wcslen
malloc
_adjust_fdiv
_wcsicmp
Exports
Exports
DllRundll
iiuuu
setxml
tdtss
tssdtdssddsss
upsss
yyiisadfasd
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 716B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ