64376b118c7063beb7a74c9d76f3c534

Sharing

Copy URL Twitter E-mail

General

Target

64376b118c7063beb7a74c9d76f3c534
Size

3.1MB
MD5

64376b118c7063beb7a74c9d76f3c534
SHA1

416e1bbe3aa906bf62e471d01024a2f0857cb80c
SHA256

d0c4be1360efffbc56e8df0d456f1475e907565170360212e014a053c0835ad8
SHA512

79fbd195a20e4f809f284796216bc6730b2bc2ed9a77be660473578a1f28ee41deccc2612b8c548787048611d43c26f70633aa0c84fe61a569023354cb3249de
SSDEEP

49152:b55sYZ+8OQ55vxNow7xo8MLgLEsVj7Fk5ZiXLSD00ea+Epci6h6pV6Qv:bjsYoZM552GygosxqiGDnea+UtR6Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64376b118c7063beb7a74c9d76f3c534

Files

64376b118c7063beb7a74c9d76f3c534
.dll windows:6 windows x64 arch:x64

704902f69e3d70d168c4d2933a311809

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GlobalMemoryStatusEx
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowLongPtrW
CharUpperBuffW

winmm

timeGetTime

msvcp140

?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

winhttp

WinHttpQueryDataAvailable

vcruntime140

memcmp

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf_s

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-math-l1-1-0

round

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-time-l1-1-0

_time64

wtsapi32

WTSSendMessageW

advapi32

RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

Sections

.text
Size: - Virtual size: 820KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

704902f69e3d70d168c4d2933a311809

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winmm

msvcp140

winhttp

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

wtsapi32

advapi32

Sections

.text Size: - Virtual size: 820KB

.rdata Size: - Virtual size: 314KB

.data Size: - Virtual size: 235KB

.pdata Size: - Virtual size: 16KB

.gfids Size: - Virtual size: 68B

.tls Size: 512B - Virtual size: 9B

.vmp0 Size: - Virtual size: 2.6MB

.vmp1 Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 512B - Virtual size: 44B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 820KB

.rdata
Size: - Virtual size: 314KB

.data
Size: - Virtual size: 235KB

.pdata
Size: - Virtual size: 16KB

.gfids
Size: - Virtual size: 68B

.tls
Size: 512B - Virtual size: 9B

.vmp0
Size: - Virtual size: 2.6MB

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 512B - Virtual size: 44B

.rsrc
Size: 512B - Virtual size: 469B