7759970fef572f69527650ad9a9fe217

Sharing

Copy URL

Twitter E-mail

General

Target

7759970fef572f69527650ad9a9fe217
Size

22KB
MD5

7759970fef572f69527650ad9a9fe217
SHA1

e30b7ff8bc56785005ce47f90d2f26b3ac4c8ec6
SHA256

fa6107f9fb90f74caa16ce16f17ace430cd37628d11e1bc16e2b0a473e8b9a67
SHA512

135653e1eb014405ac349c690c791331d0ceb8510157fb72003e5e22b44103c135738b2a59dd1477b579e0ec898acda9851f64fc7bf2fd6c9960a174c3917831
SSDEEP

384:taPW3nHoJgwcVnnp8/VS21Kn2anL9B+f8RQzaCTkO8JcvoAhF91s2GgT9aWtj:IW3nHEncV6tS21Kn2anLGf8RyjwTJ4oi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7759970fef572f69527650ad9a9fe217

Files

7759970fef572f69527650ad9a9fe217
.dll windows:5 windows x86 arch:x86

cb0eb8a9bb706701926088a36fc84287

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
VirtualProtect
GetCurrentProcess
Sleep
WriteFile
lstrlenA
lstrcmpiW
CreateMutexA
OpenMutexA
GetModuleFileNameA
GetModuleHandleW
CreateFileA
GetFileAttributesA
GlobalFree
CloseHandle
GlobalAlloc
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime

advapi32

RegOpenKeyExA
RegQueryValueExA

msvcr120

strchr
fclose
tmpfile
sprintf
_purecall
memmove
strrchr
strstr
isalnum
fopen
fread
fseek
ftell
printf
_beginthread
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler3
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
?terminate@@YAXXZ
__clean_type_info_names_internal
_strnicmp
atoi
strncmp
_iob
fprintf
strncpy
memchr
??3@YAXPAX@Z
memset
memcpy
malloc
free
??2@YAPAXI@Z
strtok
_strdup

ws2_32

WSACleanup
WSAStartup
gethostbyname
socket
send
recv
htons
connect
closesocket

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z

psapi

GetModuleInformation

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb0eb8a9bb706701926088a36fc84287

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcr120

ws2_32

msvcp120

psapi

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 20KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 20KB

.reloc
Size: 1KB - Virtual size: 1KB