VisibleEntry
Static task
static1
Behavioral task
behavioral1
Sample
file.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
file.dll
Resource
win10v2004-20250129-en
General
-
Target
file
-
Size
448KB
-
MD5
ce99e91e6c2a6defe1a86462870ba321
-
SHA1
f3d31b5d4bec32a50e8a76430c801d1b8c4e6b70
-
SHA256
58ddbea084ce18cfb3439219ebcf2fc5c1605d2f6271610b1c7af77b8d0484bd
-
SHA512
005fc1fedaa4862134e3f38f6521302b6f9db82117b70e17c95157a4205a84348dbbcb5a037c125da89d32621740b4bf1613935da32a5555a8a1eb17b6f42106
-
SSDEEP
12288:VPNXbjc+dHPgpgA6RiagtnIkJvEFZoZ/g1n:VFjZegjiagtnhOFZA/g1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file
Files
-
file.dll windows:6 windows x86 arch:x86
01c6e0fa43bc11eeb38e45281031d076
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteFile
CloseHandle
GetFileSizeEx
ReadFile
SetFileAttributesW
WaitForSingleObject
CreateThread
VirtualAlloc
VirtualFree
MoveFileW
HeapAlloc
HeapFree
GetProcessHeap
Sleep
CreateFileW
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
GetVolumePathNamesForVolumeNameW
GetVolumeInformationW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
lstrcmpW
GetModuleFileNameW
GetTickCount
CreateProcessA
OpenMutexW
CreateMutexW
GetLastError
GetTempPathW
FindNextFileW
FindFirstFileW
FindClose
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
GetNativeSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
shell32
SHChangeNotify
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
Exports
Exports
Sections
.text Size: 346KB - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ