ab5ad42a01666b232b6b822269c19a9e427f2dc209c07ca7d770b379d7e18171

Sharing

Copy URL Twitter E-mail

General

Target

ab5ad42a01666b232b6b822269c19a9e427f2dc209c07ca7d770b379d7e18171
Size

151KB
MD5

40ef7331f1f448a6a2f678f857dd6375
SHA1

4d7513c9a414cbc33ccc6d87833acf7655a634c7
SHA256

ab5ad42a01666b232b6b822269c19a9e427f2dc209c07ca7d770b379d7e18171
SHA512

fbeb4cf451758c96e80d87a3f3f26fb3692b6e53783c331dca87c71f06bc78f5ac3a6a74f0654eb41fee808d3137eb203ae445b9b77f807b25dda9a0c75cf6e9
SSDEEP

3072:639Snel/RhjOsy9cMRRRpxtuTptPKFT9+GFUI:ESnonjizmGlF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab5ad42a01666b232b6b822269c19a9e427f2dc209c07ca7d770b379d7e18171

Files

ab5ad42a01666b232b6b822269c19a9e427f2dc209c07ca7d770b379d7e18171
.dll windows:5 windows x86 arch:x86

e9b243b67bcbc603fbf607fc2de3f137

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WriteFile
SizeofResource
CreateFileA
GetFileAttributesA
LockResource
LoadResource
FindResourceA
GetSystemDirectoryA
Sleep
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
EncodePointer
DecodePointer
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
HeapAlloc
RaiseException
IsProcessorFeaturePresent
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetModuleFileNameW
HeapReAlloc

slabhiddevice

HidDevice_IsOpened
HidDevice_GetHidGuid
HidDevice_Close
HidDevice_Open
HidDevice_SetTimeouts
HidDevice_GetHidString
HidDevice_GetNumHidDevices
HidDevice_GetInputReportBufferLength
HidDevice_GetMaxReportRequest
HidDevice_GetInputReport_Interrupt
HidDevice_GetOutputReportBufferLength
HidDevice_SetOutputReport_Interrupt

Exports

Exports

ConnectDevices
DisconnectDevices
GetDevicesGuid
GetDevicesString
GetNumDevices
I2C_ReadBytes
I2C_WriteBytes
MDIO_ReadBytes
MDIO_ReadWords
MDIO_WriteBytes
MDIO_WriteWords

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e9b243b67bcbc603fbf607fc2de3f137

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

slabhiddevice

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 109KB - Virtual size: 109KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 109KB - Virtual size: 109KB

.reloc
Size: 4KB - Virtual size: 4KB