rundll32.zip
- SHA256 ca8e2f2436c025f4b4910e13b13d807abafc6e6b9ffab0669fdb10c0a574eea0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CM108.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
CM108.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target rundll32.zip
- Size 3.6MB
- Sample261024-ybllpsff63
- SHA256 ca8e2f2436c025f4b4910e13b13d807abafc6e6b9ffab0669fdb10c0a574eea0
- MD5 754f0ca700cc6fdc4ed462e275672a2e
- SHA1 f4e3939244df73883cde38e4d6454fe4bbfd0c17
- SHA512 58a43f081c71c17deb260049401631823658bb8d0f771f7f2172648df92f9528ede6741765c6776834f2cfda3b3258f7d158f15226f7c6ef2ce31f84ca75ff59
- SSDEEP 98304:qbPISLbJwDAn66VrSWmPzZ/QEUEthcIY/vf9JAIuXkyN3I3TpmfJ3v3kOh:KlJeyTVu8G6IY/9JqJN3IDMh3v3h
- TLSH T1F106332409A649B5DAE83F35B0CCFA64FC9336ED1BB2351D5D0EE4898B47289CCAF541
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CM108.dll unpack001/rundll32.exe
File Explorer
-
rundll32.zip.zip 3.6MB
-
CM108.dll.dll 12.3MB
-
rundll32.exe.exe 55KB
CM108.dll
- IMPHASH c7e8d63a6d578250f8e629bb916c5969
- SHA256 0d55fe60669695358279101ac088765ba058bc6ba8a1d3dcf8def699ac0734e6
- MD5 7124bec6fab1d185d923b1ba58ef472d
- SHA1 94559be857d307977d399a0ebf4af50653ea39ac
- SHA512 304ddf4468dde050ff574a7138c14f3bd9dd17ca4a04cee798bbca63308a7e7cc07565da5bd9bcbcd1cd1349519915030ae0f3981a0207d76225ab9c40662433
- SSDEEP 98304:qxa+3D8qKuFqXoFICZ8nqbbwI+2I+qI++I+qI+2I+qI+uI+qI+2I+KI+eI+3sAV:qYu8qKuFJrV70
- TLSH T182D6B4C3F56B94F5F93505308324A7D0086EAF78E63360ED39AEBC94C9B3583255DA29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
628404
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
mmioClose
mmioOpenA
mmioSeek
mmioSetInfo
mmioAdvance
mmioGetInfo
waveOutClose
waveOutOpen
mixerOpen
mmioDescend
mixerGetNumDevs
mixerClose
mixerGetLineInfoA
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetLineControlsA
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
mmioRead
waveOutWrite
mixerGetDevCapsA
mmioAscend
waveOutGetErrorTextA
waveOutPause
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
cfgmgr32
CM_Get_Sibling
CM_Get_DevNode_Registry_PropertyA
CM_Locate_DevNodeA
CM_Get_Child
CM_Get_Parent
setupapi
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
kernel32
lstrcmpiA
GlobalGetAtomNameA
lstrcatA
SetLastError
FindClose
FindFirstFileA
FindNextFileA
GetCurrentThread
lstrcmpA
SuspendThread
DuplicateHandle
ReadFile
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationA
GetFullPathNameA
TlsAlloc
GlobalFindAtomA
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
FindResourceExA
GetProcessVersion
GlobalFlags
GetCPInfo
GetOEMCP
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetFileTime
SystemTimeToFileTime
RtlUnwind
RaiseException
HeapAlloc
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
ExitProcess
TerminateProcess
HeapSize
HeapReAlloc
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalDeleteAtom
lstrcpyA
GetModuleHandleA
GetCurrentThreadId
GetEnvironmentVariableA
SetFilePointer
WriteFile
InterlockedDecrement
InterlockedIncrement
OpenEventA
GetThreadLocale
ResumeThread
GetFileSize
OutputDebugStringA
GetVersion
lstrlenA
GetSystemDirectoryA
GetCurrentProcess
GetSystemDefaultLangID
GetModuleFileNameA
GetTickCount
MulDiv
CreateMutexA
SetCurrentDirectoryA
WinExec
CreateProcessA
WritePrivateProfileStringA
GetSystemDefaultLCID
SetThreadLocale
GetTempPathA
GlobalAddAtomA
GetWindowsDirectoryA
lstrcpynA
InterlockedExchange
LocalAlloc
LocalFree
CreateFileA
GetLastError
DeviceIoControl
WideCharToMultiByte
SetThreadPriority
TerminateThread
WaitForSingleObject
FindResourceA
SizeofResource
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersionExA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetFileAttributesA
CreateThread
ExitThread
FreeLibrary
LoadLibraryA
GetProcAddress
Sleep
SetEvent
WaitForMultipleObjects
ResetEvent
EnterCriticalSection
LeaveCriticalSection
CreateEventA
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
OpenFile
MultiByteToWideChar
GlobalHandle
user32
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
IsDialogMessageA
SetWindowTextA
MoveWindow
EnableMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
LoadStringA
ValidateRect
CharUpperA
UnregisterClassA
LoadCursorA
GetSysColorBrush
GetClassNameA
AppendMenuA
CheckMenuItem
UnionRect
IntersectRect
EqualRect
GrayStringA
TabbedTextOutA
IsWindowVisible
RegisterHotKey
ClientToScreen
FillRect
FrameRect
GetCursor
SetClassLongA
DestroyCursor
RedrawWindow
RegisterWindowMessageA
ExitWindowsEx
GetCapture
DrawEdge
LoadIconA
LoadBitmapA
GetWindowLongA
SetWindowLongA
DrawTextA
CopyRect
SetCapture
ReleaseCapture
IsRectEmpty
GetDesktopWindow
SetRectEmpty
SetRect
RegisterDeviceNotificationA
UnregisterDeviceNotification
MessageBoxA
LoadImageA
BeginPaint
UnregisterHotKey
DestroyMenu
DefWindowProcA
LoadMenuA
GetSubMenu
DeleteMenu
InsertMenuA
TrackPopupMenu
FindWindowA
SetForegroundWindow
SetFocus
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
DispatchMessageA
TranslateMessage
PostQuitMessage
GetParent
OffsetRect
GetDC
InflateRect
ReleaseDC
GetCursorPos
GetWindowRect
KillTimer
PtInRect
InvalidateRect
SetTimer
GetSysColor
GetSystemMetrics
IsWindow
EnableWindow
GetClientRect
SendMessageA
MsgWaitForMultipleObjects
PostMessageA
GetForegroundWindow
CharLowerBuffA
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetWindow
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
MapDialogRect
SetWindowPos
GetActiveWindow
wsprintfA
GetTopWindow
SetActiveWindow
GetAsyncKeyState
GetDlgItem
IsWindowEnabled
GetNextDlgGroupItem
WindowFromPoint
GetFocus
ScreenToClient
SetCursor
PeekMessageA
CreatePopupMenu
EndPaint
gdi32
EnumFontFamiliesExA
DPtoLP
CreateSolidBrush
BitBlt
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
GetDeviceCaps
GetMapMode
GetObjectA
SetBkMode
StretchBlt
GetTextExtentPoint32A
GetBkMode
SetTextColor
RoundRect
TextOutA
PtVisible
RectVisible
ExtTextOutA
Escape
GetPixel
CreateDIBSection
LineTo
MoveToEx
Arc
Rectangle
CreatePen
GetClipBox
SetBkColor
CreateBitmap
SaveDC
RestoreDC
GetStockObject
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
Polygon
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
shell32
ShellExecuteA
Shell_NotifyIconA
comctl32
ord17
_TrackMouseEvent
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ole32
CreateStreamOnHGlobal
StringFromCLSID
CoUninitialize
CLSIDFromString
CoInitialize
CoCreateInstance
oleaut32
SysAllocStringLen
VariantClear
VariantInit
gdiplus
GdipFillRectangleI
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateBitmapFromFile
GdipSetInterpolationMode
GdipCloneBrush
GdipCreateSolidFill
GdipDeleteBrush
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipDrawImageI
GdipCreateFromHDC
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipMeasureString
GdipDrawString
GdipSetTextRenderingHint
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDeletePen
GdipCreatePen1
GdipCreateFontFamilyFromName
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawLineI
GdipDeleteGraphics
CMICtrlWnd
CMIJackWnd
CPlApplet
Name
.text
Size
760KB
Virtual Size
758KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Shared
Size
4KB
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11.3MB
Virtual Size
11.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
96KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=11, version=8047,
count=6, id=10, version=8047,
count=5, id=12, version=7291,
count=1, id=29, version=9178,
count=2, id=25, version=9210,
count=37, id=19, version=8022,
count=26, productName=Unmarked objects (old),
count=1, id=49, version=9044,
count=38, id=14, version=7299,
count=181, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=578, id=1, productName=Unmarked objects,
count=23, id=19, version=8034,
count=224, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
rundll32.exe
- IMPHASH 5f775eafb44bbb454aacab920e4bc44c
- SHA256 ca3176c675bc1d39e8a77e984c6f63d54bded96101c30cd338730b7ddadae837
- MD5 5efc6d1d9c53d580889ab2831b2e7aa9
- SHA1 f3cc4453c97d4cc9958012b1517bfaa98f5260ae
- SHA512 7d083a3910bd5f7c55b0517996b4a6277ec3c274f963024f45534592f268a518af7b882f6401e96f3b7816f8f0de6552e26434a6c7749f830a807747d7411556
- SSDEEP 1536:2os9ltedApHCzH3LBj879ZR7jkazMF4PnImEWR:2oAp27q9ZR7jkazM6f1DR
- TLSH T1BF434B23BA5440B0DEE131B4166E723A52AED6605325C5C39F255BEAED283C1EE343CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
39584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
rundll32.pdb
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memcpy
_o__wtoi
_o_exit
_o_free
_o_malloc
_o_memcpy_s
_o_terminate
__CxxFrameHandler3
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
_o___p__commode
memcmp
api-ms-win-crt-string-l1-1-0
memmove_s
memset
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoInitializeSecurity
CoResumeClassObjects
CoAddRefServerProcess
CLSIDFromString
CoReleaseServerProcess
CoCreateInstance
CoUninitialize
CoWaitForMultipleHandles
api-ms-win-core-file-l1-1-0
SetFilePointer
GetFileAttributesW
CreateFileW
ReadFile
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
LoadStringW
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
GetSystemWow64Directory2W
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-synch-l1-1-0
CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
SetEvent
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapSetInformation
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetErrorMode
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processenvironment-l1-1-0
SearchPathW
GetCommandLineW
api-ms-win-core-processthreads-l1-1-0
DeleteProcThreadAttributeList
CreateProcessW
TerminateProcess
ExitProcess
GetCurrentThreadId
InitializeProcThreadAttributeList
GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
UpdateProcThreadAttribute
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-wow64-l1-1-0
Wow64EnableWow64FsRedirection
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
IsProcessorFeaturePresent
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-console-l1-2-0
AttachConsole
FreeConsole
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-console-l1-1-0
WriteConsoleW
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-sidebyside-l1-1-0
ActivateActCtx
DeactivateActCtx
ReleaseActCtx
QueryActCtxW
CreateActCtxW
api-ms-win-downlevel-shlwapi-l1-1-0
PathIsRelativeW
api-ms-win-downlevel-shlwapi-l2-1-0
SHSetThreadRef
imagehlp
ImageDirectoryEntryToData
ntdll
RtlNtStatusToDosError
RtlWow64IsWowGuestMachineSupported
RtlImageNtHeader
NtQuerySystemInformation
RtlSetSearchPathMode
NtSetInformationToken
NtClose
NtSetInformationProcess
NtQueryInformationToken
NtOpenProcessToken
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=33145,
count=73, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1237, id=1, productName=Unmarked objects,
count=13, id=260, version=33145,
count=31, id=261, version=33145,
count=3, id=259, version=33145,
count=7, id=264, version=33145,
count=1, id=253, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,