Control_RunDLL
Static task
static1
Behavioral task
behavioral1
Sample
3-Ard2eQaJX2oB.dll
Resource
win7-20240903-en
General
-
Target
d2d98c6a99f91898a76f7a878a7a5f8a08d0b55bc05b49d4319aa0b6b7d7525f
-
Size
235KB
-
MD5
58e429ebc9ad3da651358e1db0c14078
-
SHA1
7c1876c2bd30ea0c84bed7fa75560b2d1ec244ff
-
SHA256
d2d98c6a99f91898a76f7a878a7a5f8a08d0b55bc05b49d4319aa0b6b7d7525f
-
SHA512
b0f461794be9e79befa2a9836f713911afab2614ccddc2d0d1bbbc48730837857986564c52dfe20885c2e5ff6ac902f52ce48820ae633127236b1808c8182244
-
SSDEEP
6144:tuaQ4jfujIA2XML0o8UENWS5j3n9a5AsGfjA:tdjfqDcMEj0SdX9QP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3-Ard2eQaJX2oB.dll
Files
-
d2d98c6a99f91898a76f7a878a7a5f8a08d0b55bc05b49d4319aa0b6b7d7525f.zip
Password: infected
-
3-Ard2eQaJX2oB.dll.dll windows:6 windows x86 arch:x86
263ec39fb76c45b7650e1a58167cfb76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualQuery
FreeLibrary
IsBadReadPtr
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedExchange
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
EnumSystemLocalesW
VirtualProtect
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
LoadLibraryW
LoadLibraryExW
OutputDebugStringW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetCurrentThread
VirtualFree
GetNativeSystemInfo
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
LoadLibraryA
WinExec
VirtualAllocExNuma
GlobalFree
GlobalUnlock
CreateFileA
GlobalLock
GlobalSize
GlobalReAlloc
GlobalAlloc
GetProcAddress
VirtualAlloc
GetCurrentProcess
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetUserDefaultLCID
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetModuleFileNameW
GetLastError
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
HeapSize
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CreateSemaphoreW
InterlockedIncrement
CreateFileW
user32
WinHelpA
DefMDIChildProcA
DefFrameProcA
LoadIconA
LoadCursorA
GetParent
MessageBoxA
GetClientRect
SetScrollRange
SetScrollPos
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
EnableMenuItem
GetMenu
CharLowerA
CharUpperA
SendDlgItemMessageA
GetDlgItem
EndDialog
DialogBoxParamA
CreateDialogParamA
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA
LoadStringA
gdi32
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
DPtoLP
MoveToEx
SetROP2
SetMapMode
SelectPalette
SaveDC
RealizePalette
RestoreDC
Rectangle
LineTo
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreatePalette
CreateDIBitmap
CreateCompatibleDC
BitBlt
SelectObject
comdlg32
GetSaveFileNameA
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 8.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ