d8b549e78f60995f845d3440e1fd50a6

Sharing

Copy URL

Twitter E-mail

General

Target

d8b549e78f60995f845d3440e1fd50a6
Size

701KB
MD5

d8b549e78f60995f845d3440e1fd50a6
SHA1

470e30ffc713396d101949dffeed025e7083919d
SHA256

f73b0df56a13548f550be8e48e49209979e7d6256b477d6bc5cd1456c1fb5da1
SHA512

7b9fe78042fe09cf7c1f13d5eca24d2302b9cd324894f8be0ad2b63278aa76a41ae0917edd4e7e7b0df234756510f8849c5c10d7c2f23c86519cc64b4f110c37
SSDEEP

12288:HUAQSxb6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsB:Hz3xb6fq8Np6bTPPaBreaZlYCOSVol22

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

d8b549e78f60995f845d3440e1fd50a6

resource
d8b549e78f60995f845d3440e1fd50a6

Files

d8b549e78f60995f845d3440e1fd50a6
.dll windows:6 windows x86 arch:x86

b5c6badd398e2e3aa283a40a40432c6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LockResource
FreeLibrary
GetProcAddress
VirtualProtect
OpenProcess
GetCurrentThreadId
Sleep
GetSystemTime
CreateSemaphoreW
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
GetTempPathW
CreateFileW
GetVolumeInformationW
QueryPerformanceCounter
GetVersionExW
GetDateFormatW
OutputDebugStringW
CloseHandle
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
HeapSize
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetConsoleCtrlHandler
GetFileType
GetStdHandle
HeapReAlloc
HeapFree
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
MultiByteToWideChar
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
LoadLibraryExW
QueryPerformanceFrequency
ExitProcess
GetModuleHandleExW
GetCurrentThread
HeapAlloc
GetTimeZoneInformation
GetTimeFormatW
WriteConsoleW

user32

CreateMenu
DeferWindowPos
BeginDeferWindowPos
UnregisterHotKey
TranslateMessage
RegisterWindowMessageW
GetPropW

msacm32

acmDriverClose
acmFormatChooseW
acmFilterDetailsW
acmFilterEnumW
acmDriverEnum
acmDriverPriority
acmFormatEnumW
acmFilterTagEnumW
acmFormatTagDetailsW
acmDriverMessage
acmFormatSuggest
acmFilterTagDetailsW
acmFormatTagEnumW
acmFilterChooseW
acmDriverOpen
acmDriverDetailsW
acmFormatDetailsW
acmMetrics
acmDriverAddW
acmDriverRemove
acmDriverID
acmGetVersion

Exports

Exports

BeGrass
Fieldeight
Often
Townenter

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c6badd398e2e3aa283a40a40432c6c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msacm32

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 487KB

.rdata Size: 185KB - Virtual size: 185KB

.data Size: 6KB - Virtual size: 620KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 488KB - Virtual size: 487KB

.rdata
Size: 185KB - Virtual size: 185KB

.data
Size: 6KB - Virtual size: 620KB

.reloc
Size: 21KB - Virtual size: 20KB