23663011a79198f3b1b2a990f694a05ebbbc678ebb78469304fff4a8e234e3ba

Sharing

Copy URL

Twitter E-mail

General

Target

23663011a79198f3b1b2a990f694a05ebbbc678ebb78469304fff4a8e234e3ba
Size

9.9MB
MD5

063fff7063836d64a1bd1f60efd3f092
SHA1

e69b23b3bb865d8c2e769cec91a1fece0ceb4f3c
SHA256

23663011a79198f3b1b2a990f694a05ebbbc678ebb78469304fff4a8e234e3ba
SHA512

3e5f248e311d6dc5273d1815de225d5a5c7d0fd1343584535f21fc9b78a797a4b0a9e7f4db186dc66e157cdc7626f412a35f6d25db5e2fdba023142c11f94b24
SSDEEP

196608:Upg/u6TP4+m4UAKOBnz2hSoz+K6I/sMp37Dcp1BYV3an2cHTN2Oiz:Up8P4EUAKOBqhSoz+K6CV37QYV3a2cJ2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23663011a79198f3b1b2a990f694a05ebbbc678ebb78469304fff4a8e234e3ba

Files

23663011a79198f3b1b2a990f694a05ebbbc678ebb78469304fff4a8e234e3ba
.dll windows:5 windows x86 arch:x86

cf8cbca35104b3fc47cd6b62e55e6294

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
MultiByteToWideChar
GetLastError
DeleteFileA
CloseHandle
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
CreateDirectoryA
VirtualQuery
LoadLibraryA
FreeLibrary
SizeofResource
WriteFile
FindResourceA
CreateFileA
SetDllDirectoryA
LockResource
LoadResource
FindClose
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
FindNextFileA
TerminateProcess
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
GetModuleFileNameA
HeapSize
WriteConsoleW
ReadConsoleW
FreeEnvironmentStringsW
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
LoadLibraryExW
InterlockedFlushSList
CreateFileW
GetFileType
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
ReadFile
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
GetProcessHeap
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
SetEndOfFile

shlwapi

PathRemoveFileSpecA
PathFileExistsA

Exports

Exports

pretx

Sections

.text
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf8cbca35104b3fc47cd6b62e55e6294

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 145KB - Virtual size: 145KB

.rdata Size: 70KB - Virtual size: 69KB

.data Size: 4KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 500B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 9.7MB - Virtual size: 9.7MB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 145KB - Virtual size: 145KB

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 4KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 500B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 9.7MB - Virtual size: 9.7MB

.reloc
Size: 9KB - Virtual size: 8KB