294643760b4aba96595bbba3de3087f2

Sharing

Copy URL Twitter E-mail

General

Target

294643760b4aba96595bbba3de3087f2
Size

104KB
MD5

294643760b4aba96595bbba3de3087f2
SHA1

6ecd3bf1dac47d79facc0988e46f886d89bf9c76
SHA256

26afb08fed9365d5a5afc420dde9d007893b0bf0111b5094973601d7d2667c8a
SHA512

7f29762fc3c6cdbe699dc190ce2c7d8630e291510f37ff04dd2d0842489b63719ed8e8f2d8c6230ba1bace7afdcd181c974614707744702c393a2da320798448
SSDEEP

1536:5f2NGA8B2+D1su0yYlrmoWaa90E0zIoGig5Q5rSH3oC8wvzV3Wklk9ncobUfsKOH:p2NGAp+664dEu48whxlkreOu0v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
294643760b4aba96595bbba3de3087f2

Files

294643760b4aba96595bbba3de3087f2
.dll windows:6 windows x86 arch:x86

3f54b64de241a4527df0725ddfe75eec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateFileMappingW
CreateFileW
DecodePointer
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
EnumSystemCodePagesW
ExitProcess
FlushFileBuffers
FreeEnvironmentStringsW
GetACP
GetCPInfo
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTimeZoneInformation
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
RtlUnwind
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileTime
SetLastError
SetStdHandle
SetTimerQueueTimer
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteConsoleW
WriteFile

wininet

CreateUrlCacheEntryW
HttpSendRequestExW
InternetCheckConnectionW
InternetOpenW
InternetWriteFile

winmm

auxGetDevCapsA
auxSetVolume
mmDrvInstall
mmioClose
mmioInstallIOProcA
waveInGetErrorTextW
waveInGetNumDevs
waveOutUnprepareHeader

wsock32

WSACleanup
WSAIsBlocking
closesocket
ntohs
ord1103

setupapi

SetupDiAskForOEMDisk
SetupDiClassGuidsFromNameExW
SetupDiEnumDriverInfoW
SetupFindFirstLineW
SetupGetSourceFileLocationA
SetupQueueCopySectionW

rpcrt4

I_RpcNsBindingSetEntryNameA
I_RpcSend
RpcMgmtInqServerPrincNameA
RpcSsDestroyClientContext
RpcSsDontSerializeContext
RpcStringBindingComposeA

oleaut32

VarDecAbs
VarDecFromI2
VarI1FromDisp
VarI2FromDisp
VarNot

Exports

Exports

dtzsk

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f54b64de241a4527df0725ddfe75eec

Headers

File Characteristics

Imports

kernel32

wininet

winmm

wsock32

setupapi

rpcrt4

oleaut32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 9KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 424B

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 9KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 424B