20eaaaaa2b631db053388df05e5d7c6648733b5185b5582b8f516143e6c00552

Sharing

Copy URL Twitter E-mail

General

Target

20eaaaaa2b631db053388df05e5d7c6648733b5185b5582b8f516143e6c00552
Size

138KB
MD5

bf18aae5c1ac2f5f42d9d078f420b610
SHA1

321f07b896bfd42b03eecc9cad824648f0b92924
SHA256

20eaaaaa2b631db053388df05e5d7c6648733b5185b5582b8f516143e6c00552
SHA512

1b447422277be0e27766eec76231528203e8ac82250ac3af3274c911415fdb69da4e1591caf500a4b11abe7acb83d4239413e4d1e3abd9708be21beb73d06f31
SSDEEP

3072:bZvInR2MWnh1RWHgPqlVSFJ0p9zaR5PBSoDg:bkqGV+J03azZSqg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20eaaaaa2b631db053388df05e5d7c6648733b5185b5582b8f516143e6c00552

Files

20eaaaaa2b631db053388df05e5d7c6648733b5185b5582b8f516143e6c00552
.dll windows x86

5433d7c13d0796bc700723d22273a490

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libncursesw6

SP
_nc_mblen
_nc_mbtowc
_nc_screen_of
_nc_wcrtomb
_nc_wcwidth
copywin
delwin
derwin
getmouse
is_linetouched
newpad
setcchar
stdscr
wadd_wch
waddch
waddnstr
wattrset
wbkgdset
wclear
wclrtobot
wclrtoeol
wcursyncup
wdelch
wenclose
werase
win_wch
win_wchnstr
winch
winnstr
wins_wch
winsch
winsdelln
wmouse_trafo
wmove
wresize
wsyncup
wtouchln

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__mb_cur_max
_amsg_exit
_assert
_errno
_initterm
_iob
_lock
_strdup
_strtoi64
_strtoui64
_unlock
_write
abort
atof
atoi
atol
calloc
fputc
free
fwrite
getc
isalnum
isalpha
iscntrl
isprint
isspace
iswctype
isxdigit
localeconv
malloc
memcpy
memset
realloc
setlocale
strchr
strcmp
strerror
strlen
strncmp
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcslen

libsystre-0

regcomp
regexec
regfree

Exports

Exports

TYPE_ALNUM
TYPE_ALPHA
TYPE_ENUM
TYPE_INTEGER
TYPE_IPV4
TYPE_NUMERIC
TYPE_REGEXP
_nc_Copy_Argument
_nc_Copy_Type
_nc_Default_Field
_nc_Default_FieldType
_nc_Default_Form
_nc_First_Active_Field
_nc_Free_Argument
_nc_Free_Type
_nc_Internal_Validation
_nc_Make_Argument
_nc_Position_Form_Cursor
_nc_Refresh_Current_Field
_nc_Set_Current_Field
_nc_Set_Form_Page
_nc_Synchronize_Attributes
_nc_Synchronize_Options
_nc_TYPE_ALNUM
_nc_TYPE_ALPHA
_nc_TYPE_ENUM
_nc_TYPE_INTEGER
_nc_TYPE_IPV4
_nc_TYPE_NUMERIC
_nc_TYPE_REGEXP
_nc_Unset_Current_Field
_nc_Widen_String
_nc_form_cursor
_nc_generic_fieldtype
_nc_get_fieldbuffer
_nc_set_generic_fieldtype
_nm__SP
_nm__stdscr
current_field
data_ahead
data_behind
dup_field
dynamic_field_info
field_arg
field_back
field_buffer
field_count
field_fore
field_index
field_info
field_init
field_just
field_opts
field_opts_off
field_opts_on
field_pad
field_status
field_term
field_type
field_userptr
form_driver
form_driver_w
form_fields
form_init
form_opts
form_opts_off
form_opts_on
form_page
form_request_by_name
form_request_name
form_sub
form_term
form_userptr
form_win
free_field
free_fieldtype
free_form
link_field
link_fieldtype
move_field
new_field
new_fieldtype
new_form
new_form_sp
new_page
pos_form_cursor
post_form
scale_form
set_current_field
set_field_back
set_field_buffer
set_field_fore
set_field_init
set_field_just
set_field_opts
set_field_pad
set_field_status
set_field_term
set_field_type
set_field_userptr
set_fieldtype_arg
set_fieldtype_choice
set_form_fields
set_form_init
set_form_opts
set_form_page
set_form_sub
set_form_term
set_form_userptr
set_form_win
set_max_field
set_new_page
unfocus_current_field
unpost_form

Sections

.text
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5433d7c13d0796bc700723d22273a490

Headers

DLL Characteristics

File Characteristics

Imports

libncursesw6

kernel32

msvcrt

libsystre-0

Exports

Exports

Sections

.text Size: 95KB - Virtual size: 94KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 8KB

/4 Size: 18KB - Virtual size: 18KB

.bss Size: - Virtual size: 2KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 95KB - Virtual size: 94KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 8KB

/4
Size: 18KB - Virtual size: 18KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 2KB