2d75df6d79d24eb0c4b20445e51d44eb

Sharing

Copy URL Twitter E-mail

General

Target

2d75df6d79d24eb0c4b20445e51d44eb
Size

91KB
MD5

2d75df6d79d24eb0c4b20445e51d44eb
SHA1

1f85c6a8fc9c188c95e1e8112d64ed5755b40017
SHA256

a08aa9debcd5728f1ee470ba972d50de4e9fa621cb891867d0c2ac3c80870e62
SHA512

9b2cd3e2baa470ff7920e6cb9876d5192c82544eaa235cca9b9905da34148e82c77dfd31822a9a667c3a9dd251cf26e4cc89b47b09ba5ceda7d5d3c8816085aa
SSDEEP

1536:zBaC3M/psRoukADndLC+lSgzsFKmMbQ/AwcHbd9hQ5osWjcdustoOcl:zBPR6So+YyXNBBzQ53usjK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d75df6d79d24eb0c4b20445e51d44eb

Files

2d75df6d79d24eb0c4b20445e51d44eb
.dll windows:6 windows x86 arch:x86

aa134d72f264691331220cb0a8fb9891

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imm32

ImmEscapeW
ImmSetConversionStatus
ImmGetCompositionFontW
ImmSetCompositionStringW

shlwapi

StrTrimW
StrFormatByteSizeW
SHGetValueW
StrFromTimeIntervalW
StrChrIW
PathQuoteSpacesW
StrCmpIW

kernel32

HeapAlloc
HeapFree
GetProcessHeap
VirtualAlloc
HeapSize
LCMapStringW
HeapReAlloc
RtlUnwind
RaiseException
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetFilePointerEx
CloseHandle
EnumSystemCodePagesA
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
ExitProcess
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
LoadLibraryExW
WriteFile
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
CreateFileW

mscms

IsColorProfileValid
EnumColorProfilesA

winmm

waveOutGetDevCapsA

rpcrt4

NdrNsGetBuffer
NdrRpcSsDefaultFree
RpcStringFreeW
RpcBindingSetObject
I_RpcMapWin32Status

crypt32

CertFindAttribute
CertComparePublicKeyInfo
CertAddEncodedCTLToStore
CertEnumCertificatesInStore

ole32

OleCreateLinkFromDataEx
CreateFileMoniker
OleConvertIStorageToOLESTREAMEx
StgCreateStorageEx
OleCreateMenuDescriptor
IsEqualGUID

winspool.drv

AddPrinterDriverW
GetJobA
EnumPrinterDriversA
DeletePrinterDriverExA
AddPrinterDriverA
DeletePrinterKeyW

Exports

Exports

tskcfxmci

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa134d72f264691331220cb0a8fb9891

Headers

File Characteristics

Imports

imm32

shlwapi

kernel32

mscms

winmm

rpcrt4

crypt32

ole32

winspool.drv

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 57KB

.bss Size: - Virtual size: 7KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 11KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 504B

.text
Size: 57KB - Virtual size: 57KB

.bss
Size: - Virtual size: 7KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 504B