0e1fa8b6b0b30c1b7e73f49d0060185b44304a31d93e10b7659bc756d9687935

Sharing

Copy URL

Twitter E-mail

General

Target

0e1fa8b6b0b30c1b7e73f49d0060185b44304a31d93e10b7659bc756d9687935
Size

2.2MB
MD5

f63ae5061bfcf1e4ed48aa6e9af08546
SHA1

d00b2599bf013ce5e38ebc5f4a490c391e013600
SHA256

0e1fa8b6b0b30c1b7e73f49d0060185b44304a31d93e10b7659bc756d9687935
SHA512

287538c4000b7d33783c621eb89742e0f668b64a01e2bf623861f07a3e9ee9838b8737b9799f6dad6a2cf32af0ec9aeb5c058178af153ff51c8700e4dce16071
SSDEEP

49152:vEcHRRntZqTraJz64F0ZGXPUC88MxGt9QEtXCYNEpH4oy:5yrwfF0ZGfPMxGME8Hf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e1fa8b6b0b30c1b7e73f49d0060185b44304a31d93e10b7659bc756d9687935

Files

0e1fa8b6b0b30c1b7e73f49d0060185b44304a31d93e10b7659bc756d9687935
.dll windows:5 windows x86

27e78050c7bafcacb9bbd4f712eea30d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

clusapi

ClusterRegCreateKey

winmm

waveInAddBuffer
waveOutSetVolume

ws2_32

select

rasapi32

RasEnumConnectionsW

lz32

LZRead

advapi32

CryptReleaseContext
SaferSetPolicyInformation
GetLengthSid

psapi

GetModuleFileNameExA

wininet

InternetReadFileExA

shell32

ShellExecuteExA
SHGetFolderPathAndSubDirW

user32

WindowFromDC
PostThreadMessageA
LockWindowUpdate
SetDlgItemTextW
SetDoubleClickTime
GetUpdateRgn
MonitorFromPoint
ValidateRgn

winspool.drv

GetPrinterW

rpcrt4

I_RpcBindingInqLocalClientPID

msvcrt

srand
putc

gdi32

AddFontResourceA
Pie
AbortDoc

shlwapi

StrRStrIW

oleaut32

GetRecordInfoFromGuids
GetErrorInfo

kernel32

InterlockedPushEntrySList
SetStdHandle
GetProcAddress
GetModuleHandleA
CloseHandle
GetModuleFileNameA
GetModuleFileNameW
GetSystemTimeAsFileTime

crypt32

CryptRegisterOIDFunction

version

VerFindFileW

Sections

.text
Size: 252KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ZYDZ
Size: 200KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 344KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CODE
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27e78050c7bafcacb9bbd4f712eea30d

Headers

File Characteristics

Imports

clusapi

winmm

ws2_32

rasapi32

lz32

advapi32

psapi

wininet

shell32

user32

winspool.drv

rpcrt4

msvcrt

gdi32

shlwapi

oleaut32

kernel32

crypt32

version

Sections

.text Size: 252KB - Virtual size: 248KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 32KB - Virtual size: 35KB

ZYDZ Size: 200KB - Virtual size: 196KB

.CRT Size: 344KB - Virtual size: 342KB

CODE Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 4KB - Virtual size: 848B

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 252KB - Virtual size: 248KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 32KB - Virtual size: 35KB

ZYDZ
Size: 200KB - Virtual size: 196KB

.CRT
Size: 344KB - Virtual size: 342KB

CODE
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 4KB - Virtual size: 848B

.reloc
Size: 12KB - Virtual size: 11KB