DllRegisterServer
Behavioral task
behavioral1
Sample
0889271c721391d625a19391275f0e6bf244a5548a1a6eb673c6e16a48e960e1.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0889271c721391d625a19391275f0e6bf244a5548a1a6eb673c6e16a48e960e1.dll
Resource
win10v2004-20241007-en
General
-
Target
0889271c721391d625a19391275f0e6bf244a5548a1a6eb673c6e16a48e960e1
-
Size
170KB
-
MD5
7339d426a3968dbfcd9f1f6043f2d91f
-
SHA1
af40aa784ab77899200410ea45809cac3db909a0
-
SHA256
0889271c721391d625a19391275f0e6bf244a5548a1a6eb673c6e16a48e960e1
-
SHA512
04ec77928e5a4b62bf75a4613ba105e43a2a58458cb8d07a32055014987b14f0c8b5e72d48ca664c5efbc34270b549a9ca08e7b36487a6c574feacc920b83bfa
-
SSDEEP
3072:CM6/5WHoRkeQilLJWs+XSpo66ftDdgf6Q7e7Ca4vR1ECBLMK9pb6r9BhMTvPhbQn:kYHriRJeeo6st9Ae7HI1iKHUnudrW
Malware Config
Extracted
zloader
10/03
https://dhteijwrb.host/milagrecf.php
https://aquolepp.pw/milagrecf.php
-
build_id
83
Signatures
-
Zloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0889271c721391d625a19391275f0e6bf244a5548a1a6eb673c6e16a48e960e1
Files
-
0889271c721391d625a19391275f0e6bf244a5548a1a6eb673c6e16a48e960e1.dll regsvr32 windows:6 windows x86 arch:x86
c4a8909c0bccc13eaa9bdf93bacea9e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetCurrentProcessId
GetLastError
GetTempPathA
Exports
Exports
Sections
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ