f4b4f95f4c8d9f32dcd54565a0626f6e

Sharing

Copy URL

Twitter E-mail

General

Target

f4b4f95f4c8d9f32dcd54565a0626f6e
Size

820KB
MD5

f4b4f95f4c8d9f32dcd54565a0626f6e
SHA1

c423b4ae7c02841400f29d16609131d333618a06
SHA256

608a569b3caa54231e76b65fe3e1945a4c8af8a16eb1707a1ddb687fb3228495
SHA512

66c164ed0fd57a8d59d42db3d5369f98432e327ee182af7f7f1fe20c486b27ce94ef1c79977ca9978a3a568d1d7cc54a3a1ef770f7d55815c207b73393cd5e1d
SSDEEP

24576:IO6c3oCrVA7bEK7mJaW2eX8TvE81oIzsk6EzCUfk7uu:GuVeEK7mmeX8TBoIzsk6hUf4B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
f4b4f95f4c8d9f32dcd54565a0626f6e

Files

f4b4f95f4c8d9f32dcd54565a0626f6e
.dll windows:6 windows x86 arch:x86

f6ed57c140219f49a1adbd0334b819b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtectEx
GetCurrentProcess
GetSystemTimeAsFileTime
GetLocalTime
CreateSemaphoreW
LoadLibraryW
CreateProcessW
GetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateFileW
SetFileAttributesW
WaitForSingleObjectEx
OutputDebugStringW
OutputDebugStringA
CloseHandle
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
GetCurrentThread
HeapFree
HeapAlloc
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
CreateThread

ole32

OleUninitialize
OleInitialize
OleSetContainedObject

dbghelp

SymUnloadModule
ImageRvaToSection
MakeSureDirectoryPathExists
ImageRvaToVa
SymUnloadModule64
ImagehlpApiVersion
ImagehlpApiVersionEx
MapDebugInformation
UnDecorateSymbolName

imagehlp

TouchFileTimes
ImageUnload
MapFileAndCheckSumA
MapAndLoad

Exports

Exports

BoneFoot
Countinstrument
During
Largecamp

Sections

.text
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6ed57c140219f49a1adbd0334b819b7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

dbghelp

imagehlp

Exports

Exports

Sections

.text Size: 509KB - Virtual size: 508KB

.rdata Size: 284KB - Virtual size: 284KB

.data Size: 6KB - Virtual size: 602KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 509KB - Virtual size: 508KB

.rdata
Size: 284KB - Virtual size: 284KB

.data
Size: 6KB - Virtual size: 602KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 18KB