cb5909f4e5aff08135befc2ed50396741a02cd573582403ffe7facac98c5987b

Sharing

Copy URL Twitter E-mail

General

Target

cb5909f4e5aff08135befc2ed50396741a02cd573582403ffe7facac98c5987b
Size

872KB
MD5

535c345a27021f6f9df3f7a46b9ecafd
SHA1

fdc9c4332227bb9dde54dac69ba40dce5dc5c681
SHA256

cb5909f4e5aff08135befc2ed50396741a02cd573582403ffe7facac98c5987b
SHA512

d3faec1622f5039b196788e0fe5cfa55d80bc19e0100445bac154cfb648dd77d260599f6f440d36837cf2ac10689d78497abe7b40cb5b71fb3bc1718cff17904
SSDEEP

24576:bWIT9DC7QmjDHn4JH5o/uMSqIe7iOjejJtWM:b9DCcw47dKijJtW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb5909f4e5aff08135befc2ed50396741a02cd573582403ffe7facac98c5987b

Files

cb5909f4e5aff08135befc2ed50396741a02cd573582403ffe7facac98c5987b
.dll windows x86

c9b1df2c3fd0f9ceafbd55b8b3b77fa8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
GetModuleHandleW
VirtualProtect
VirtualFree
GlobalFree
GetVersionExW
GlobalAlloc
MultiByteToWideChar
InitializeCriticalSection
CreateThread
Sleep
EnterCriticalSection
LeaveCriticalSection
WriteFile
FindFirstFileW
GetTickCount
FindNextFileW
FindClose
CloseHandle
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetCurrentProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
VirtualAlloc
LoadLibraryW
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetLastError
ExitProcess
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc

user32

wsprintfW

advapi32

RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
RegSetValueExW

shell32

SHGetSpecialFolderPathW

shlwapi

StrStrIW
StrStrIA

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetOpenUrlA

Exports

Exports

DllLoader

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 776KB - Virtual size: 781KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9b1df2c3fd0f9ceafbd55b8b3b77fa8

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

wininet

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 776KB - Virtual size: 781KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 776KB - Virtual size: 781KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 12KB - Virtual size: 8KB