VisibleEntry
Static task
static1
Behavioral task
behavioral1
Sample
05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
Resource
win10v2004-20241007-en
General
-
Target
05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
-
Size
800KB
-
MD5
f74cec233a9609461e7518dd4c90207b
-
SHA1
92408a8233567f8b10f30f83dfcdd98effe96dca
-
SHA256
05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431
-
SHA512
231a0fd347933b31bbfbebebd274c4da40177360f35f295e5fa8384ad30ad11666221c39be28e56866e4b7254f9cbe3956368352ea7f4fe48e89427df7a6bcb4
-
SSDEEP
12288:z0LOFSM++OeO+OeNhBBhhBBhlJ2//R18nBIs0I3sHGzVylK7Nb0tq0mxHu84NeiB:zGOFSmKqEI3sHGzVylK7Nb0U1Hu8WK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
Files
-
05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll.dll windows:6 windows x86 arch:x86
23e2fb791954fbabda43d79392204d36
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
GetModuleFileNameW
lstrcmpW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
CreateFileW
WriteFile
CloseHandle
GetFileSizeEx
CreateProcessA
SetFileAttributesW
WaitForSingleObject
CreateThread
VirtualAlloc
VirtualFree
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetEndOfFile
WriteConsoleW
SetStdHandle
OpenMutexW
CreateMutexW
GetLastError
GetTempPathW
FindNextFileW
FindFirstFileW
ReadFile
FindClose
Sleep
GetCurrentThreadId
GetNativeSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
HeapReAlloc
HeapSize
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
shell32
SHChangeNotify
advapi32
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CryptGenRandom
Exports
Exports
Sections
.text Size: 600KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ