0696e1297cfd2bb2d72c9180855457fa

Sharing

Copy URL

Twitter E-mail

General

Target

0696e1297cfd2bb2d72c9180855457fa
Size

104KB
MD5

0696e1297cfd2bb2d72c9180855457fa
SHA1

73b54438f86c88aa559702cf52f92d68196f172f
SHA256

32cfb555f19fd90d2c92fd89453d16388b18f2808dcb21186e4375d49c8b0620
SHA512

8517373d9ea2ff91af4a9d2117abfa66987a0f086b97c643f3785f4d522d0ddc8512fed2667c1131fa6366edb6b534f73a055126c5634b3d90269af58d71ba5a
SSDEEP

1536:6WGfGAXqrlOjRsu0R7mfJdYCD0EczMY3cFJeg0Hv75jcTZr03Wklk9ncobUfs/Ga:DGfGAilO2InDYE2JaAxlkrjGP8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0696e1297cfd2bb2d72c9180855457fa

Files

0696e1297cfd2bb2d72c9180855457fa
.dll windows:6 windows x86 arch:x86

8f03da1fec8b473bdf3a1611e0117ca5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imm32

ImmCreateContext
ImmGetCompositionStringA
ImmGetGuideLineA
ImmGetIMCLockCount
ImmInstallIMEW
ImmReSizeIMCC
ImmRegisterWordW

shlwapi

IntlStrEqWorkerW
PathBuildRootW
SHRegOpenUSKeyW
SHRegWriteUSValueA
StrChrIA
StrDupA
StrTrimW
UrlIsNoHistoryA

kernel32

CloseHandle
CopyFileExA
CreateFileMappingW
CreateFileW
DecodePointer
DeleteCriticalSection
DeleteFiber
DeleteFileW
EncodePointer
EnterCriticalSection
EnumDateFormatsA
EnumSystemCodePagesW
ExitProcess
FlushFileBuffers
FreeEnvironmentStringsW
GetACP
GetCPInfo
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessTimes
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GlobalAddAtomA
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
RtlUnwind
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteConsoleW
WriteFile

winspool.drv

AbortPrinter
ClosePrinter
ConnectToPrinterDlg
DeletePrinterKeyW

pdh

PdhCollectQueryData
PdhConnectMachineA
PdhReadRawLogRecord
PdhUpdateLogFileCatalog
PdhVbCreateCounterPathList

crypt32

CertEnumCTLContextProperties
CertFindSubjectInCTL

Exports

Exports

rmrkznj

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f03da1fec8b473bdf3a1611e0117ca5

Headers

File Characteristics

Imports

imm32

shlwapi

kernel32

winspool.drv

pdh

crypt32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 9KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 424B

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 9KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 424B