AutoBuilderProcess
Static task
static1
Behavioral task
behavioral1
Sample
file.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.dll
Resource
win10v2004-20250129-en
General
-
Target
file
-
Size
524KB
-
MD5
20d03f8272648fa3fd31e222b8e2220f
-
SHA1
ac20624e8aff3d4f9c42a8e2ddd493250e631f47
-
SHA256
1391c20a26f248f7c602f20096bf1886cfe7e4d151602a1258a9bbe7c02c1c80
-
SHA512
3bcfde35141671b4de022ae2423d020e53de35075c9a2c0a2dde45dc993364543af443dc97e6d3cc96c9a1d34533d6adb50c2495a23b5c4de97f64b3176ebd70
-
SSDEEP
12288:SwCt9ZABL6wADs7yjyYTW3nMxIg/NmGta1WeGcvc4OulNI:AHUADs+jVW3nMxIKMOa1Wpecule
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file
Files
-
file.dll windows:6 windows x86 arch:x86
775ac66e9bea2bda7dd0f9493ca130de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
GetVolumeInformationW
GetTempPathW
GetVolumePathNamesForVolumeNameW
CloseHandle
GetLastError
DeviceIoControl
ReleaseMutex
CreateMutexW
OpenMutexW
Sleep
GetCurrentProcessId
GetTickCount
GetModuleFileNameW
LocalAlloc
LocalFree
FindVolumeClose
MoveFileW
FreeConsole
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
FindNextVolumeW
FindNextFileW
FindFirstVolumeW
FindFirstFileW
FindClose
CreateFileW
FormatMessageW
GetCurrentDirectoryW
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetFileType
GetStdHandle
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
FormatMessageA
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetFileAttributesW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
user32
SystemParametersInfoW
shell32
SHChangeNotify
advapi32
RegSetValueExW
RegCreateKeyExW
SetSecurityDescriptorDacl
SetFileSecurityW
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetEntriesInAclW
Exports
Exports
Sections
.text Size: 376KB - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ