DllMain
Static task
static1
Behavioral task
behavioral1
Sample
core/cmd.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
core/cmd.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
core/future_64.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
core/future_64.dll
Resource
win10v2004-20241007-en
General
-
Target
99c1060f61d53bab5328cf79116d02352979e93348957455af21f2182a952631
-
Size
364KB
-
MD5
187a7c0895e92536fb49272c9222e322
-
SHA1
bab4c30f88ad53ad8947292151c059cc78947ccb
-
SHA256
99c1060f61d53bab5328cf79116d02352979e93348957455af21f2182a952631
-
SHA512
08accd06d5041c0f12af62d7652f8272fc8874ff3e48f5073e9ec45ad7a3692797ce83d0ca802da137bdfe385917c33c3330444c34af16965eec65c2f546175b
-
SSDEEP
6144:eWVqGqr8w0JzpapmeprYgSlG+wGrZ8VU2reGodTp+/rZRUk4tFXbVBoPvRgLP9LS:pVqGqCzpEm6tnGrOVUR8itFbVmxIljXK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/core/future_64.dat
Files
-
99c1060f61d53bab5328cf79116d02352979e93348957455af21f2182a952631.zip
Password: infected
-
core/cmd.bat
-
core/future_64.dat.dll windows:6 windows x64 arch:x64
4cb994c23e66fd9c9ab6fb3bbf2fd26c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetCommandLineW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
TlsGetValue
WideCharToMultiByte
Exports
Exports
Sections
.text Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
core/license.dat