ldr_ukq9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ldr_ukq9.exe
Size

14.7MB
MD5

c900eb1386e060a545789fecc504431a
SHA1

77bdbad5d38e0f16d68064dc39d72cf94437c875
SHA256

4376b5092f13e949fd22b7b3b85fbefab51a7a764d18b680e4d75a46fdaae4f3
SHA512

27c6366f5aff29ff9bc15faa01226ba0323b308e84eec55d4c878b5cbc09e0d5626e0b250c29561aad65a549e61382198ac4624051d89e5f5b89837ccca3fd44
SSDEEP

196608:15zv0PlqkgF1QF1SXkczaKG05fxPgBSER0hPHv5uMe+w71lTiELJayl3l0V7cbg1:fzvGlSi13UWWWyvv5ucw711iAJzg6bg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ldr_ukq9.exe

Files

ldr_ukq9.exe
.exe windows:6 windows x64 arch:x64

eeeb8fde83422621b62ca8f3fca789c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdiplus

GdipAlloc

kernel32

GetVersion
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

PostThreadMessageA

gdi32

GetDIBits

advapi32

RegCloseKey

ole32

GetHGlobalFromStream

ntdll

RtlLookupFunctionEntry

ws2_32

send

dbghelp

SymGetTypeInfo

wininet

InternetOpenW

iphlpapi

GetAdaptersInfo

Exports

Exports

TNRF

Sections

.text
Size: - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.2an
Size: - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.'=;
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Hup
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eeeb8fde83422621b62ca8f3fca789c4

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

advapi32

ole32

ntdll

ws2_32

dbghelp

wininet

iphlpapi

Exports

Exports

Sections

.text Size: - Virtual size: 470KB

.rdata Size: - Virtual size: 326KB

.data Size: - Virtual size: 51KB

.pdata Size: - Virtual size: 22KB

_RDATA Size: - Virtual size: 348B

.2an Size: - Virtual size: 8.6MB

.'=; Size: 4KB - Virtual size: 3KB

.Hup Size: 14.7MB - Virtual size: 14.7MB

.reloc Size: 512B - Virtual size: 56B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 470KB

.rdata
Size: - Virtual size: 326KB

.data
Size: - Virtual size: 51KB

.pdata
Size: - Virtual size: 22KB

_RDATA
Size: - Virtual size: 348B

.2an
Size: - Virtual size: 8.6MB

.'=;
Size: 4KB - Virtual size: 3KB

.Hup
Size: 14.7MB - Virtual size: 14.7MB

.reloc
Size: 512B - Virtual size: 56B

.rsrc
Size: 512B - Virtual size: 480B