04447a2725f293f8a9746b0db58fa832

Sharing

Copy URL Twitter E-mail

General

Target

04447a2725f293f8a9746b0db58fa832
Size

436KB
MD5

04447a2725f293f8a9746b0db58fa832
SHA1

caf87c9fa89e4f6039a3c296bbcd7ffce4cdf829
SHA256

b1d0b5b4ce535cdbf0b8fbd21c8583fbade52436da55fbb7c1d4c75d47eca75c
SHA512

2ecccfda9267faa7ac30307d455601fa79711e4163a71770807b70e2228e6b5ce335d46a7b3eb0810f0b0f0e404eaa27dc2bbabc3334fb654352b3c39a661e06
SSDEEP

6144:OgMK+UjmlPHBQKICVMLSzJvvsb2Z1tDDnaARYcri8f4XAIrIiG:OLK+JPHBcCVMLSzJvvQ2Z1Za8gXAIHG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04447a2725f293f8a9746b0db58fa832

Files

04447a2725f293f8a9746b0db58fa832
.dll windows x86

d31c477cc159d9752f6e8ef56c0d2af9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

FindClosePrinterChangeNotification
DeletePrinter

wininet

FindCloseUrlCache
FindFirstUrlCacheEntryExW

advapi32

RegGetValueA
GetSecurityDescriptorControl

version

GetFileVersionInfoA
GetFileVersionInfoSizeW

urlmon

FindMimeFromData

user32

GetClassNameA
GetCaretPos
GetTabbedTextExtentA
LoadKeyboardLayoutA
GetWindowThreadProcessId
GetMenuItemCount
GetMenuItemInfoA
EnumWindows
GetKeyNameTextA
LoadStringW
IsWinEventHookInstalled
GetThreadDesktop
EnumThreadWindows
GetClipCursor
GetWindowRgn
DialogBoxParamA
LoadCursorA
LoadBitmapW
GetWindowInfo
GetUserObjectInformationW
ModifyMenuW
GetMenuContextHelpId

secur32

FreeCredentialsHandle
GetUserNameExA
InitializeSecurityContextW

powrprof

GetCurrentPowerPolicies

ws2_32

shutdown

kernel32

GlobalAddAtomW
GetModuleFileNameA
GetThreadPriority
ExitProcess
GetFileType
FindActCtxSectionStringW
LocalLock
GetBinaryTypeA
GetPrivateProfileSectionNamesW
GlobalLock
GetStartupInfoA
GetCurrencyFormatA
GetPrivateProfileSectionA
ExpandEnvironmentStringsA
GetVolumePathNameW
GetConsoleScreenBufferInfo
GetPriorityClass
GetTapePosition
lstrcpynW
GetLongPathNameA
FindNextFileA
GetUserGeoID
FindFirstChangeNotificationA
VirtualFree
GetSystemInfo
VirtualQueryEx
LocalFileTimeToFileTime

comdlg32

GetFileTitleA

gdi32

GdiFlush
GetDIBits
GetTextCharsetInfo
FillPath
GetROP2
GetCurrentPositionEx

msvcrt

fputwc
fputws
strtol
toupper
fgetws
fgetwc
vfwprintf
strcoll

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt1
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d31c477cc159d9752f6e8ef56c0d2af9

Headers

DLL Characteristics

File Characteristics

Imports

winspool.drv

wininet

advapi32

version

urlmon

user32

secur32

powrprof

ws2_32

kernel32

comdlg32

gdi32

msvcrt

Sections

.text Size: 8KB - Virtual size: 4KB

.rdata Size: 192KB - Virtual size: 188KB

.data Size: 76KB - Virtual size: 80KB

.crt1 Size: 64KB - Virtual size: 60KB

.crt Size: 60KB - Virtual size: 59KB

.rsrc Size: 4KB - Virtual size: 888B

.reloc Size: 28KB - Virtual size: 25KB

.text
Size: 8KB - Virtual size: 4KB

.rdata
Size: 192KB - Virtual size: 188KB

.data
Size: 76KB - Virtual size: 80KB

.crt1
Size: 64KB - Virtual size: 60KB

.crt
Size: 60KB - Virtual size: 59KB

.rsrc
Size: 4KB - Virtual size: 888B

.reloc
Size: 28KB - Virtual size: 25KB