9aca2899cd11d9f18ba389ff1798693ef1cadfa70ffbb54f5550279cdd4fc4b0

Sharing

Copy URL Twitter E-mail

General

Target

9aca2899cd11d9f18ba389ff1798693ef1cadfa70ffbb54f5550279cdd4fc4b0
Size

2.1MB
MD5

567ecc68cce34732caf152e3b9885c84
SHA1

4d4eef7d3b0f45184d251b984be63cfc4ead0254
SHA256

9aca2899cd11d9f18ba389ff1798693ef1cadfa70ffbb54f5550279cdd4fc4b0
SHA512

6eb380351ef36a17243fe8b4141a5e58e20268eb97835df419f3000b243481f3ab54b034b0f0310068893c47fb5715d5153b22c53a3a1e179b76e2b1de93902a
SSDEEP

24576:WnAdBTy/Lqahm+NhTiwE+cXB9T+RNGaitf3C8KJflSf9P:WnAaTqkBiweHT+RJih3lEfY9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9aca2899cd11d9f18ba389ff1798693ef1cadfa70ffbb54f5550279cdd4fc4b0

Files

9aca2899cd11d9f18ba389ff1798693ef1cadfa70ffbb54f5550279cdd4fc4b0
.dll windows x86

2ce5cc9de42aa2bcbc16a77c5fb1f032

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetCurrentThreadId
GlobalFree
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalHandle
InitializeCriticalSection
DeleteCriticalSection
LocalUnlock
LocalLock
LocalAlloc
GetModuleFileNameA
MoveFileExA
CloseHandle
GetFileSize
CreateFileA
GetSystemDirectoryA
GetModuleHandleA
SetNamedPipeHandleState
WaitNamedPipeA
UnmapViewOfFile
WaitForSingleObject
SetEvent
MapViewOfFile
OpenFileMappingA
OpenEventA
TlsFree
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventA
ResetEvent
WaitForMultipleObjects
GetWindowsDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetLocaleInfoA
ReadFile
WriteFile
SetThreadPriority
InterlockedIncrement
GetFileAttributesExA
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
SetConsoleCtrlHandler
HeapReAlloc
GetProcAddress
GetTimeZoneInformation
SetStdHandle
GetFileType
ExitThread
ResumeThread
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
SetLastError
GetCurrentThread
GetTickCount
GetCurrentProcessId
SetHandleCount
GetStdHandle
GetStartupInfoA
FatalAppExitA
GetTimeFormatA
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
SetFilePointer
FlushFileBuffers
InterlockedExchange
VirtualQuery
HeapSize
GetACP
GetOEMCP
VirtualProtect
GetSystemInfo
CompareStringA
CompareStringW
SetEnvironmentVariableA
RaiseException
GetLocaleInfoW
SetEndOfFile
SetCurrentDirectoryA
GetFullPathNameA
GetCurrentDirectoryA
GetLastError
FormatMessageA
LocalFree
FreeLibrary
EnterCriticalSection
WideCharToMultiByte
LeaveCriticalSection
GetDriveTypeA
PeekNamedPipe
GetFileInformationByHandle
SetEnvironmentVariableW

user32

MessageBoxA
wsprintfA

advapi32

CryptAcquireContextA
CryptReleaseContext
RegOpenKeyExA
RegEnumValueA
RegCloseKey
CryptGenRandom

wsock32

WSACleanup
WSAStartup
__WSAFDIsSet
select
inet_ntoa
recv
send
setsockopt
getservbyname
shutdown
getpeername
gethostbyname
WSASetLastError
inet_addr
ioctlsocket
htons
connect
ntohs
socket
closesocket
WSAGetLastError

Exports

Exports

DllMain
LoadByOrdinal
SQLAllocConnect
SQLAllocEnv
SQLAllocHandle
SQLAllocStmt
SQLBindCol
SQLBindParameter
SQLBrowseConnect
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLColAttribute
SQLColAttributes
SQLColumnPrivileges
SQLColumns
SQLConnect
SQLDescribeCol
SQLDescribeParam
SQLDisconnect
SQLDriverConnect
SQLEndTran
SQLError
SQLExecDirect
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLForeignKeys
SQLFreeConnect
SQLFreeEnv
SQLFreeHandle
SQLFreeStmt
SQLGetConnectAttr
SQLGetConnectOption
SQLGetCursorName
SQLGetData
SQLGetDiagField
SQLGetDiagRec
SQLGetEnvAttr
SQLGetFunctions
SQLGetInfo
SQLGetStmtAttr
SQLGetStmtOption
SQLGetTypeInfo
SQLMoreResults
SQLNativeSql
SQLNumParams
SQLNumResultCols
SQLParamData
SQLParamOptions
SQLPrepare
SQLPrimaryKeys
SQLProcedureColumns
SQLProcedures
SQLPutData
SQLRowCount
SQLSetConnectAttr
SQLSetConnectOption
SQLSetCursorName
SQLSetEnvAttr
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttr
SQLSetStmtOption
SQLSpecialColumns
SQLStatistics
SQLTablePrivileges
SQLTables
SQLTransact

Sections

.text
Size: 672KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ce5cc9de42aa2bcbc16a77c5fb1f032

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wsock32

Exports

Exports

Sections

.text Size: 672KB - Virtual size: 669KB

.rdata Size: 104KB - Virtual size: 100KB

.data Size: 1.2MB - Virtual size: 1.2MB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 44KB - Virtual size: 40KB

.reloc Size: 32KB - Virtual size: 29KB

.text
Size: 672KB - Virtual size: 669KB

.rdata
Size: 104KB - Virtual size: 100KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 44KB - Virtual size: 40KB

.reloc
Size: 32KB - Virtual size: 29KB