3[.]blob | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3.blob
Size

130KB
MD5

a40f13721ec6519ab74d9966ee67b796
SHA1

365496ff9cf9e4996d53d31d174c15a61a34d639
SHA256

fb8861a3327cce1d36b15fabb53a2db0ce225cf26f3ceb440ff3586895d4f22d
SHA512

b61d2b127157dbb0d13d05253ac0f64cabd2aefa8d67a51f648b38cefd929257e724117d86af962a93a7cbf7ec79e23e4d13eea8ad0fe67dfb3bc1925e55621e
SSDEEP

3072:QbvtEPqFzfJ9hcQqhxyrJ9OlO47meMfL7sbgDOV4b75q+DOD3VXAXc:QbvRFN9hcyrJ9Ok47MLD7q+D6RAXc

Score

N/A

Malware Config

Signatures

Files

3.blob
.dll windows x86

3aa7550e90d606f4f2e5b997ceb8c158

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
SetEvent
CloseHandle
CreateProcessW
GetModuleFileNameW
CreateEventW
GetSystemDirectoryW
ResetEvent
LocalFree
FormatMessageA
GetComputerNameA
WriteConsoleW
SetEndOfFile
WaitForSingleObject
PeekNamedPipe
CreatePipe
WriteFile
ReadFile
GetLastError
GetStartupInfoW
HeapReAlloc
HeapSize
ReadConsoleW
GetStringTypeW
FlushFileBuffers
SetStdHandle
CreateFileW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
InterlockedFlushSList
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
DecodePointer

user32

wsprintfW

advapi32

RegSetValueExW
RegCloseKey
GetUserNameA
RegOpenKeyExW

iphlpapi

GetAdaptersInfo

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpQueryOption
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpWriteData

Exports

Exports

DllEntry

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3aa7550e90d606f4f2e5b997ceb8c158

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

iphlpapi

winhttp

Exports

Exports

Sections

.text Size: 85KB - Virtual size: 85KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 3KB - Virtual size: 7KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 85KB - Virtual size: 85KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 3KB - Virtual size: 7KB

.reloc
Size: 5KB - Virtual size: 5KB