5688819ecc27dbe45e9d8ac4037dbec30421373b6af04f1d6d2906c6a935a975

Sharing

Copy URL Twitter E-mail

General

Target

5688819ecc27dbe45e9d8ac4037dbec30421373b6af04f1d6d2906c6a935a975
Size

228KB
MD5

3ffb788ed93ba3baf0015cac1bf3d3e7
SHA1

e2dd1288ed43d339507836ce82f743b602143623
SHA256

5688819ecc27dbe45e9d8ac4037dbec30421373b6af04f1d6d2906c6a935a975
SHA512

b7a562971c4bb0f841ccf9fcc7208116cd03cac77363d1a45e50d78c0963bd5e65632e375d05bb83cba196b07a272e1e9d545629451288726db7f104ad899ce9
SSDEEP

3072:1AakRSyNMyMuj1zyo74RvArYFm5AnhQHEgbVO3+gYtPma9lceSeizuceEQm/ocv3:1IZBGYqA0Fm5TkgY3+SVf9cK3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5688819ecc27dbe45e9d8ac4037dbec30421373b6af04f1d6d2906c6a935a975

Files

5688819ecc27dbe45e9d8ac4037dbec30421373b6af04f1d6d2906c6a935a975
.dll windows x86

c3c37b899bafa35288350c0d0e50781e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
InterlockedDecrement
CloseHandle
GetSystemTimeAsFileTime
GetModuleFileNameA
GetModuleHandleExA
OutputDebugStringA
CreateDirectoryA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
RaiseException
RtlUnwind
GetLastError
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
InterlockedFlushSList
ReadFile
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetACP
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
DeleteFileW
MoveFileExW
GetProcessHeap
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCommandLineA
GetCommandLineW
SetStdHandle
WriteConsoleW
CreateFileW
HeapSize
SetEndOfFile
InterlockedIncrement

shlwapi

PathIsDirectoryA

advapi32

SystemFunction036

Exports

Exports

SCreateInstance

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3c37b899bafa35288350c0d0e50781e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

advapi32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 159KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 5KB - Virtual size: 7KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 160KB - Virtual size: 159KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 5KB - Virtual size: 7KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB