3bb04f091730dbb0772e944f0af7183f

Sharing

Copy URL Twitter E-mail

General

Target

3bb04f091730dbb0772e944f0af7183f
Size

24KB
MD5

3bb04f091730dbb0772e944f0af7183f
SHA1

028dd58ddf5bc51fadc928d72c80b5de3122737c
SHA256

847ec21086bd39c07f2bea521ad95be51364ff032f0531d0744e9952c23cf1c2
SHA512

6c69ec1cd6181c74694ce93a0fe52041a1c7f7fd0e7c9138e2c14e413a5940452cb1d7b6c4755292ddf427040f5c3c1838ca3dbb00124d3a1c5b4564e5570c0f
SSDEEP

384:DMNhlgg6ncoFcFajM0NKUeMOyvQubxfYHQ0giK178vs:DolOcoKFGnKUeMOy4ubBYHfch

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bb04f091730dbb0772e944f0af7183f

Files

3bb04f091730dbb0772e944f0af7183f
.dll windows:5 windows x86 arch:x86

5867660a65ebc5225e59fce8be2072bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryFullProcessImageNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
OpenProcess
SuspendThread
DuplicateHandle
CreateToolhelp32Snapshot
GetThreadPriority
OpenThread
Thread32Next
Thread32First
CreateThread
CloseHandle
ReleaseMutex
OutputDebugStringA
CreateMutexA
GetModuleHandleA
GetProcAddress
Sleep
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
WaitForSingleObject
GetCurrentProcess

user32

GetDC

gdi32

DeleteDC
GetObjectA
BitBlt
GetDeviceCaps
GetDIBits
CreateDCA
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject

advapi32

RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA

shell32

ShellExecuteA

ws2_32

WSAEnumProtocolsA
connect
inet_addr
WSASend
select
WSAGetLastError
setsockopt
recv
WSACloseEvent
WSACreateEvent
WSASetLastError
closesocket
WSAResetEvent
WSASocketA
WSAWaitForMultipleEvents
WSAStartup
WSACleanup
ntohs
inet_ntoa
WSAGetOverlappedResult
htons

msvcr90

_except_handler4_common
_onexit
memset
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
free
malloc
sprintf
strncmp
atoi
realloc
strstr
printf
strrchr
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm

iphlpapi

GetExtendedTcpTable

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5867660a65ebc5225e59fce8be2072bd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

msvcr90

iphlpapi

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 32KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 32KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 2KB - Virtual size: 2KB