Static task
static1
Behavioral task
behavioral1
Sample
abb3df13cc82e49f04acade826a7426d1e2c0e3859a753cdf354bc468684ad5c.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
abb3df13cc82e49f04acade826a7426d1e2c0e3859a753cdf354bc468684ad5c.dll
Resource
win10v2004-20241007-en
General
-
Target
abb3df13cc82e49f04acade826a7426d1e2c0e3859a753cdf354bc468684ad5c
-
Size
334KB
-
MD5
d629d6c95ae6c1f63df46aa210118f7e
-
SHA1
7969458b38641d707cb58f990d54c05803cb828a
-
SHA256
abb3df13cc82e49f04acade826a7426d1e2c0e3859a753cdf354bc468684ad5c
-
SHA512
47c5267e5ea070c5ea2abcf86362d4c08839fa945a5af96442a559641a9b5cb0f261ff87e056069c8ab973272e76a3b5622bd771c963e2eae578b92ebf4d48b2
-
SSDEEP
3072:gr5rQ5b5jiw5vzKlDbUM0ob0FZ0Om6gqaO87/Jc04:eBQ5bNIlDXbvOLaxRc04
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abb3df13cc82e49f04acade826a7426d1e2c0e3859a753cdf354bc468684ad5c
Files
-
abb3df13cc82e49f04acade826a7426d1e2c0e3859a753cdf354bc468684ad5c.dll windows:4 windows x86 arch:x86
4586dfb1ab1cc6d9c861b21d4d982e1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
kernel32
CloseHandle
CompareFileTime
CompareStringA
CreateFileW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
ExpandEnvironmentStringsW
FreeLibrary
GetModuleHandleW
GetProcAddress
GetTickCount
GetUserDefaultUILanguage
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSectionEx
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
IsBadWritePtr
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
LocalSize
MultiByteToWideChar
RaiseException
ReadFile
WideCharToMultiByte
lstrcmpA
lstrcmpW
lstrcmpiW
ntdll
_vsnprintf
shlwapi
SHCreateStreamOnFileEx
StrChrA
StrChrIA
ucrtbase
__acrt_iob_func
__stdio_common_vsprintf
_strdup
free
fwrite
getenv
memchr
memcmp
memcpy
memmove
strchr
strcmp
strcspn
strlen
user32
LoadStringW
MessageBoxW
Exports
Exports
BMAPIAddress
BMAPIDetails
BMAPIFindNext
BMAPIGetAddress
BMAPIGetReadMail
BMAPIReadMail
BMAPIResolveName
BMAPISaveMail
BMAPISendMail
BuildDisplayTable@40
CbOfEncoded@4
CchOfEncoding@4
ChangeIdleRoutine@28
CloseIMsgSession@4
CreateIProp@24
CreateTable@36
DeinitMapiUtil@0
DeregisterIdleRoutine@4
DllCanUnloadNow
DllGetClassObject
EnableIdleRoutine@8
EncodeID@12
FBadColumnSet@4
FBadEntryList@4
FBadProp@4
FBadPropTag@4
FBadRestriction@4
FBadRglpNameID@8
FBadRglpszA@8
FBadRglpszW@8
FBadRow@4
FBadRowSet@4
FBadSortOrderSet@4
FBinFromHex@8
FDecodeID@12
FEqualNames@8
FGetComponentPath
FGetComponentPath@20
FPropCompareProp@12
FPropContainsProp@12
FPropExists@8
FixMAPI
FixMAPI@0
FreePadrlist@4
FreeProws@4
FtAdcFt@20
FtAddFt@16
FtDivFtBogus@20
FtMulDw@12
FtMulDwDw@8
FtNegFt@8
FtSubFt@16
FtgRegisterIdleRoutine@20
GetAttribIMsgOnIStg@12
GetOutlookVersion
GetOutlookVersion@0
GetTnefStreamCodepage
GetTnefStreamCodepage@12
HexFromBin@12
HrAddColumns@16
HrAddColumnsEx@20
HrAllocAdviseSink@12
HrComposeEID@28
HrComposeMsgID@24
HrDecomposeEID@28
HrDecomposeMsgID@24
HrDispatchNotifications@4
HrEntryIDFromSz@12
HrGetOmiProvidersFlags
HrGetOmiProvidersFlags@8
HrGetOneProp@12
HrIStorageFromStream@16
HrQueryAllRows@24
HrSetOmiProvidersFlagsInvalid
HrSetOmiProvidersFlagsInvalid@4
HrSetOneProp@8
HrSzFromEntryID@12
HrThisThreadAdviseSink@8
HrValidateIPMSubtree@20
HrValidateParameters@8
InstallFilterHook@4
IsBadBoundedStringPtr@8
LAUNCHWIZARD
LPropCompareProp@8
LaunchWizard@20
LpValFindProp@12
MAPIAddress
MAPIAdminProfiles
MAPIAdminProfiles@8
MAPIAllocateBuffer
MAPIAllocateBuffer@8
MAPIAllocateMore
MAPIAllocateMore@12
MAPIDeinitIdle@0
MAPIDeleteMail
MAPIDetails
MAPIFindNext
MAPIFreeBuffer
MAPIFreeBuffer@4
MAPIGetDefaultMalloc@0
MAPIInitIdle@4
MAPIInitialize
MAPIInitialize@4
MAPILogoff
MAPILogon
MAPILogonEx
MAPILogonEx@20
MAPIOpenFormMgr
MAPIOpenFormMgr@8
MAPIOpenLocalFormContainer
MAPIOpenLocalFormContainer@4
MAPIReadMail
MAPIResolveName
MAPISaveMail
MAPISendDocuments
MAPISendMail
MAPISendMailW
MAPIUninitialize
MAPIUninitialize@0
MNLS_CompareStringW@24
MNLS_IsBadStringPtrW@8
MNLS_MultiByteToWideChar@24
MNLS_WideCharToMultiByte@32
MNLS_lstrcmpW@8
MNLS_lstrcpyW@8
MNLS_lstrlenW@4
MapStorageSCode@4
OpenIMsgOnIStg@44
OpenIMsgSession@12
OpenStreamOnFile
OpenStreamOnFile@24
OpenTnefStream
OpenTnefStream@28
OpenTnefStreamEx
OpenTnefStreamEx@32
PRProviderInit
PpropFindProp@12
PropCopyMore@16
RTFSync
RTFSync@12
ScBinFromHexBounded@12
ScCopyNotifications@16
ScCopyProps@16
ScCountNotifications@12
ScCountProps@12
ScCreateConversationIndex@16
ScDupPropset@16
ScGenerateMuid@4
ScInitMapiUtil@4
ScLocalPathFromUNC@12
ScMAPIXFromCMC
ScMAPIXFromSMAPI
ScRelocNotifications@20
ScRelocProps@20
ScUNCFromLocalPath@12
SetAttribIMsgOnIStg@16
SwapPlong@8
SwapPword@8
SzFindCh@8
SzFindLastCh@8
SzFindSz@8
UFromSz@4
UNKOBJ_COFree@8
UNKOBJ_Free@8
UNKOBJ_FreeRows@8
UNKOBJ_ScAllocate@12
UNKOBJ_ScAllocateMore@16
UNKOBJ_ScCOAllocate@12
UNKOBJ_ScCOReallocate@12
UNKOBJ_ScSzFromIdsAlloc@20
UlAddRef@4
UlFromSzHex@4
UlPropSize@4
UlRelease@4
WrapCompressedRTFStream
WrapCompressedRTFStream@12
WrapProgress@20
WrapStoreEntryID@24
__CPPValidateParameters@8
__ValidateParameters@8
cmc_act_on
cmc_free
cmc_list
cmc_logoff
cmc_logon
cmc_look_up
cmc_query_configuration
cmc_read
cmc_send
cmc_send_documents
Sections
.text Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rodata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: 4KB - Virtual size: 53B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 320B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/14 Size: 4KB - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/29 Size: 4KB - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/41 Size: 4KB - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/55 Size: 4KB - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/67 Size: 4KB - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/80 Size: 4KB - Virtual size: 161B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/91 Size: 4KB - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ