295fed0d36a76d8473a2b5ad22548b3264f0f72ed410105b05bdaae1cde0de5d

Sharing

Copy URL

Twitter E-mail

General

Target

295fed0d36a76d8473a2b5ad22548b3264f0f72ed410105b05bdaae1cde0de5d
Size

271KB
MD5

fa7d98ef21b82974207437ba36d1125a
SHA1

d14b875d28762852460c6bc941d4f0f0209bdb30
SHA256

295fed0d36a76d8473a2b5ad22548b3264f0f72ed410105b05bdaae1cde0de5d
SHA512

e55e25c05755b60722982fcfbdd5952e753839e0701f763f353225d1bdbe044eede5522ed72c9114d0e37996d9f9437fc7449e7cdf53f72763058a0d49054201
SSDEEP

6144:MEzp4qIDRd6EqFmcCBk9LHZEPSZ/Of626BioBRXFsjf3FOUXzsezZOi:1zp4qIDqRi8ZEatP26BzzU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
295fed0d36a76d8473a2b5ad22548b3264f0f72ed410105b05bdaae1cde0de5d

Files

295fed0d36a76d8473a2b5ad22548b3264f0f72ed410105b05bdaae1cde0de5d
.dll windows:6 windows x64

5c7e916d393153d3f0f8bd39f245384d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc
CreateProcessA
GetThreadContext
VirtualAllocEx
WriteProcessMemory
SetThreadContext
ResumeThread
CloseHandle
TerminateProcess
GetCurrentProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
RtlCaptureContext
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memcpy
memset

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_cexit
_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table

Exports

Exports

AppVIsvSubsystems64_1

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c7e916d393153d3f0f8bd39f245384d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 263KB - Virtual size: 263KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 504B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 52B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 263KB - Virtual size: 263KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 504B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 52B