0638ca051916b12902246e019a7a2d7b71a821baefc3af01fc67321cfa31bf8d

Sharing

Copy URL Twitter E-mail

General

Target

0638ca051916b12902246e019a7a2d7b71a821baefc3af01fc67321cfa31bf8d
Size

10.6MB
MD5

14bd77e416d4d889f49c09ba0002be72
SHA1

e51823b7ce78938a1afab840f3b1e311277d91ae
SHA256

0638ca051916b12902246e019a7a2d7b71a821baefc3af01fc67321cfa31bf8d
SHA512

4c4d00cfea8124eb508d08a0a65620614ffa1662756376d15f0db82df5d71fe6c1b325ad89d7cab2457d5a7570e83a0d55a9497b262c003a8253d627f9110f8e
SSDEEP

196608:duqZ0aaJweL19OidaJPaJulw/aJAAeo9Oio:cJLPs0cLEWo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0638ca051916b12902246e019a7a2d7b71a821baefc3af01fc67321cfa31bf8d

Files

0638ca051916b12902246e019a7a2d7b71a821baefc3af01fc67321cfa31bf8d
.dll windows x86

6a9c3901d282f9829d938a48a77391c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
GetCommandLineA
CreateToolhelp32Snapshot
MultiByteToWideChar
GetLastError
GetFileAttributesA
DeleteFileA
Process32Next
CloseHandle
GetProcAddress
GetFileAttributesW
CreateProcessW
WideCharToMultiByte
CreateDirectoryA
VirtualQuery
SizeofResource
WriteFile
FindResourceA
GetEnvironmentVariableA
CreateFileA
LockResource
GetSystemInfo
LoadResource
FindClose
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
FindNextFileA
TerminateProcess
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
Process32First
DeleteCriticalSection
GetModuleFileNameA
HeapSize
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
ReadFile
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetStdHandle
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
DeleteFileW
GetProcessHeap
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
SetEndOfFile

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecA
PathFileExistsA

Exports

Exports

fnzprog

Sections

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10.3MB - Virtual size: 10.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a9c3901d282f9829d938a48a77391c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 188KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 4KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 500B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 10.3MB - Virtual size: 10.3MB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 188KB - Virtual size: 188KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 4KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 500B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 10.3MB - Virtual size: 10.3MB

.reloc
Size: 10KB - Virtual size: 9KB