0b414d6cf382c169b26d99af3680c38115a1dc533c4ac1c50d7c8fd50e8ee377

Sharing

Copy URL Twitter E-mail

General

Target

0b414d6cf382c169b26d99af3680c38115a1dc533c4ac1c50d7c8fd50e8ee377
Size

206KB
MD5

0ec11930a2510339ea77c5b256116acc
SHA1

441778707c4fc8358a59b8ebcbdb538b4ec577cd
SHA256

0b414d6cf382c169b26d99af3680c38115a1dc533c4ac1c50d7c8fd50e8ee377
SHA512

c53eaf2e18814d775ca401d717b5fac8dcf22660261a3e6e67035ad28ecc23117ffbc6e127f00a908e1fd18f8147c0a05b6e5102bf4a1dbba497b45a0c3737f0
SSDEEP

6144:GwESILbByV3xtev8X44Oii4iUyHO/OsHqqDLuxeZ7:7nIXBaev8XxKqnu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b414d6cf382c169b26d99af3680c38115a1dc533c4ac1c50d7c8fd50e8ee377

Files

0b414d6cf382c169b26d99af3680c38115a1dc533c4ac1c50d7c8fd50e8ee377
.dll windows:5 windows x64

96b1b16787d1144703cbc2ac4eb46bf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

iphlpapi

GetIfTable

mfc100u

ord10798
ord2286
ord5064
ord12208
ord10414
ord5910
ord13009
ord6837
ord13003
ord2577
ord3850
ord13687
ord3857
ord4256
ord4223
ord4219
ord4253
ord4274
ord4232
ord4261
ord4270
ord4240
ord4244
ord4248
ord4236
ord4265
ord4228
ord1497
ord1490
ord1492
ord1486
ord1479
ord10926
ord10928
ord12359
ord2760
ord8084
ord9734
ord5998
ord10892
ord7803
ord13001
ord10626
ord3282
ord10763
ord7957
ord13681
ord13680
ord13752
ord13769
ord13765
ord13767
ord13768
ord13766
ord2355
ord7088
ord2791
ord2794
ord12255
ord5340
ord2659
ord3608
ord7596
ord2530
ord3310
ord908
ord5868
ord7968
ord2748
ord2850
ord1240
ord3261
ord3162
ord3163
ord3250
ord9216
ord8290
ord5790
ord2019
ord11012
ord13017
ord8094
ord4171
ord2730
ord258
ord926
ord369
ord8038
ord10845
ord2354
ord12251
ord5338
ord2663
ord2884
ord2885
ord10101
ord7870
ord10805
ord11035
ord261
ord13036
ord13826
ord2444
ord957
ord10642
ord409
ord2038
ord280
ord3292
ord3290
ord898
ord2439
ord324
ord319
ord7609
ord11015
ord5021
ord5025
ord1005
ord13023
ord468
ord2054
ord4115
ord3969
ord287
ord291
ord1991
ord1212
ord815
ord1695
ord4004
ord11251
ord3362
ord1388
ord2533
ord7732
ord9763
ord10028
ord11686
ord11113
ord2456
ord1482
ord5866
ord848
ord411
ord4043
ord4059
ord4758
ord2445
ord959
ord410
ord3487
ord958
ord5426
ord2025
ord2029
ord5052
ord285
ord12756
ord2541
ord4348
ord11175
ord3704
ord286
ord11480
ord7222
ord1288
ord1457
ord856
ord10651
ord1247
ord11056
ord7608
ord12836
ord12842
ord5019
ord2458
ord2527
ord11225
ord2544
ord7316
ord7068
ord3486
ord1699
ord1428
ord1953
ord4005
ord11253
ord1698
ord321
ord13226
ord2656
ord1900
ord1276
ord2023
ord296
ord858
ord1290
ord890
ord1249
ord265
ord4131
ord1952
ord7321
ord7246
ord11463
ord13475
ord4570
ord2117
ord11157
ord11158
ord13002
ord6836
ord13008
ord8221
ord3543
ord3484
ord11542
ord6853
ord1716
ord2859
ord2858
ord2759
ord10841
ord4935
ord5255
ord9024
ord5570
ord885
ord13782
ord10658
ord12889
ord11150
ord6898
ord13191
ord266
ord12926
ord9747
ord6085
ord7573
ord4317
ord6923
ord1454
ord11197
ord1452
ord12835
ord3998
ord13188
ord13193
ord13190
ord13192
ord13189
ord3295
ord5049
ord10910
ord10918
ord3942
ord7094
ord9917
ord9189
ord8001
ord1238
ord10923
ord10922
ord10891
ord9490
ord895
ord2052
ord2017
ord2015
ord2041
ord1950
ord2007
ord396
ord1919
ord2051
ord2049
ord1911
ord1850
ord322
ord1279
ord1468
ord11523
ord4473
ord4737
ord4907
ord8174
ord4715
ord4910
ord4476
ord4612
ord4457
ord6669
ord6670
ord6660
ord4610
ord7096
ord9019
ord8037
ord5894
ord878
ord1270
ord6609
ord11703
ord11116
ord1381
ord2549
ord1278
ord6451

msvcr100

memcmp
sprintf
memset
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
_mktime64
strcpy_s
ldiv
floor
_wcsicmp
wcstol
free
malloc
fgets
fputc
fopen
feof
fgetc
fprintf
fclose
??0exception@std@@QEAA@AEBV01@@Z
_CxxThrowException
memcpy
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBD@Z
_itow
_ltow
wcstoul
srand
rand
_wtol
strncmp
_wtoi
strncpy
_time64
_waccess
ceil
_localtime64_s
_purecall
__CxxFrameHandler3

kernel32

lstrcatA
CreateMutexA
GetVersionExA
IsBadReadPtr
IsBadWritePtr
lstrcpyA
GetModuleHandleW
WaitForSingleObject
SetEvent
ReleaseMutex
CloseHandle
ReadFile
GetOverlappedResult
GetLastError
lstrlenW
GetComputerNameW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
GetPrivateProfileIntW
Sleep
WriteFile
CreateEventA
CreateFileA
OpenEventA
WideCharToMultiByte
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
LocalAlloc
LocalFree
DeleteFileW
GetTempPathW

user32

PostQuitMessage
MessageBoxW
PostMessageW
SetTimer
KillTimer
PostThreadMessageW
EnableWindow
SendMessageW

advapi32

RegOpenKeyExW
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegQueryValueExW
RegSetValueExW

shell32

SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime

wsock32

WSACleanup
inet_addr
gethostname
WSAStartup
gethostbyname

msvcp100

?_Xlength_error@std@@YAXPEBD@Z

hid

HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_FlushQueue
HidD_GetAttributes
HidD_GetHidGuid

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces

netapi32

Netbios

Exports

Exports

GetLicenseClass
GetLicenseClass1
GetLicenseClass10
GetLicenseClass11
GetLicenseClass12
GetLicenseClass13
GetLicenseClass14
GetLicenseClass15
GetLicenseClass16
GetLicenseClass17
GetLicenseClass18
GetLicenseClass2
GetLicenseClass3
GetLicenseClass4
GetLicenseClass5
GetLicenseClass6
GetLicenseClass7
GetLicenseClass8
GetLicenseClass9
GetNetLicenseClass
GetSafeguardClass
GetSignLicenseClass
GetSoftLicenseClass

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96b1b16787d1144703cbc2ac4eb46bf0

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

mfc100u

msvcr100

kernel32

user32

advapi32

shell32

oleaut32

wsock32

msvcp100

hid

setupapi

netapi32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 16KB - Virtual size: 38KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 16KB - Virtual size: 38KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 2KB - Virtual size: 2KB