14d57637f350b45be387bf0ae6e6521a14591bf4459dce79e7cb2007c770f5c2

Sharing

Copy URL Twitter E-mail

General

Target

14d57637f350b45be387bf0ae6e6521a14591bf4459dce79e7cb2007c770f5c2
Size

45KB
MD5

c094134e398716b7ee06901a60eb9672
SHA1

853db8dcff134e6a42afeda34fca557d72544f76
SHA256

14d57637f350b45be387bf0ae6e6521a14591bf4459dce79e7cb2007c770f5c2
SHA512

e4f19797312a63427311b55cd3b86b6c1852d30adf3d3060145c038a1aaafb6b91e1591b0c861f35f2ee8f5d3397b69c2e46126965de3c2f1581c1f2edd7a8ba
SSDEEP

768:D8oGGUpbDjmIdoBBir3vgKynbp5X5/aLtYpde:DYEOojwIfbpx2tYbe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14d57637f350b45be387bf0ae6e6521a14591bf4459dce79e7cb2007c770f5c2

Files

14d57637f350b45be387bf0ae6e6521a14591bf4459dce79e7cb2007c770f5c2
.dll windows:6 windows x64

3446e4dc91030389906e5144073b02b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegOpenKeyW
RegSetValueExW
RegQueryValueExW

spoolss

ClosePrinter
EnumPortsW
PackStrings
DllFreeSplStr
AllocSplStr
DllAllocSplMem
RevertToPrinterSelf
ImpersonatePrinterClient
SetJobW
OpenPrinterW
DllFreeSplMem

user32

LoadStringW

msvcrt

sprintf
free
_amsg_exit
_initterm
bsearch
strcspn
strchr
memmove
strlen
strcpy
memcmp
memset
wcsncmp
wcstoul
_wcsnicmp
_wcsicmp
wcscpy
wcscmp
memcpy
wcslen
strcmp

kernel32

SetCommTimeouts
TlsGetValue
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
Sleep
LocalReAlloc
LocalFree
LocalAlloc
GetEnvironmentVariableA
SetDefaultCommConfigW
GetDefaultCommConfigW
ReadFile
QueryDosDeviceW
lstrcmpiW
LeaveCriticalSection
GetCommTimeouts
EnterCriticalSection
DeviceIoControl
DefineDosDeviceW
CreateFileW
CloseHandle
SetLastError
WriteFile
InitializeCriticalSection
GetLastError
DisableThreadLibraryCalls
DeleteCriticalSection
lstrcmpW

ntdll

vDbgPrintExWithPrefix

Exports

Exports

InitializePrintMonitor2

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3446e4dc91030389906e5144073b02b5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

spoolss

user32

msvcrt

kernel32

ntdll

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 888B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 108B

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 888B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 108B