0db78e44417064b6fe1623982ea3f0e9bd9b719d3a9ebaf891b84751b2302cf5

Sharing

Copy URL Twitter E-mail

General

Target

0db78e44417064b6fe1623982ea3f0e9bd9b719d3a9ebaf891b84751b2302cf5
Size

153KB
MD5

de59b3327d177d41db8f6222224de555
SHA1

ac4f4a02e398671bab410ebdb321a5a33db78c08
SHA256

0db78e44417064b6fe1623982ea3f0e9bd9b719d3a9ebaf891b84751b2302cf5
SHA512

6a6c113b69866397faec22e65c183be57fb1fb9da8e9d5b125abbf471731261e3d6423e46c0506b0caaa4f65d009bb7cf946cafe8e938002a1dc9f4dc9067b45
SSDEEP

3072:q5Ml0+V7mrnPmAvpxtGUkioTmvErMB6F22T:0yV7mrnPL0UJsrpf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0db78e44417064b6fe1623982ea3f0e9bd9b719d3a9ebaf891b84751b2302cf5

Files

0db78e44417064b6fe1623982ea3f0e9bd9b719d3a9ebaf891b84751b2302cf5
.dll windows:6 windows x64 arch:x64

f087810e7be4285e85b8ad6fe3a80d15

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetVolumeInformationA
GetCurrentThread
SetThreadAffinityMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
CloseHandle
CreateFileW

Exports

Exports

BayerToRGB
DemosaicFromNefCrw
FringeCrwNef
FringeGet
FringeGet2
FringeNefToOrf
FringeOrfDeBayer
FringeSet
FringeValue
HandleCrwFringe
HandleNefFlange
MosaicForNef
MosaicPatternFromNefRaw
NefRotatedBayer
ParseMosaic
SetCpValue

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f087810e7be4285e85b8ad6fe3a80d15

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 97KB - Virtual size: 97KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 5KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 97KB - Virtual size: 97KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 5KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB