79c4053be568da4a4202af76cd4d5b5c

Sharing

Copy URL Twitter E-mail

General

Target

79c4053be568da4a4202af76cd4d5b5c
Size

15KB
MD5

79c4053be568da4a4202af76cd4d5b5c
SHA1

ab7326e42421b896f1980ad48c121413686569e7
SHA256

33befb7354f3c8a008c49a941f905f3a340c83bb6a2e0f79189a6c24cbdfa85f
SHA512

c68a51d73a541328b531cb272e7b978024b77edfc04095a8921a86c0e47e74bcbcb33d3d48a8c41d1486325868dfc233529960f3aed4210a10f23cd9684df520
SSDEEP

384:Wc84yb3rVTPXPIUpxb1HgOK2lQd6QVa698cE3vf:Wc84ybRTPPIUpxBo2lgVzE3v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79c4053be568da4a4202af76cd4d5b5c

Files

79c4053be568da4a4202af76cd4d5b5c
.dll windows:5 windows x86 arch:x86

7fab3426f973e0d218fbbdcddf7dfcd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
lstrcmpA
GetCurrentProcess
WriteFile
GetVolumeInformationA
Sleep
GetFileAttributesA
GetProcAddress
LoadLibraryA
OpenMutexA
GetModuleFileNameA
lstrcmpiW
GetModuleHandleA
CreateMutexA
VirtualProtect
WinExec
CloseHandle
LoadLibraryW
GetTickCount
IsDebuggerPresent
DecodePointer
EncodePointer
IsProcessorFeaturePresent

advapi32

RegQueryValueExA
RegOpenKeyExA

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z

msvcr120

isalnum
strncpy
strchr
fprintf
_purecall
??3@YAXPAX@Z
fclose
??2@YAPAXI@Z
free
malloc
strstr
_beginthread
strtok
fopen
fread
memmove
srand
strrchr
ftell
_getcwd
realloc
fseek
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
memcpy
__CxxFrameHandler3
sprintf
tmpfile
rand
??_V@YAXPAX@Z
_strdup
_stricmp
_CxxThrowException
memset

psapi

GetModuleInformation

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fab3426f973e0d218fbbdcddf7dfcd6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp120

msvcr120

psapi

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 33KB

.CRT Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 864B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 33KB

.CRT
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 864B