14548d9fd5e154164fbafb0a7ebc8afc

Sharing

Copy URL

Twitter E-mail

General

Target

14548d9fd5e154164fbafb0a7ebc8afc
Size

56KB
MD5

14548d9fd5e154164fbafb0a7ebc8afc
SHA1

026bafcc252b3cb4f8bab15f5c1be4e2f58a1ced
SHA256

6e972fe07e121ff3b95dc1d408aa47c3cef2934c38386a277d76ee7baeb96b4b
SHA512

895f4b691f3ac28a9e591a29d4d85474215ae62eaa82fc7ff756a881c059eee9ccc042d8c014ed0f8ce808fd197f73621ee49125a28038485a164beeda87c185
SSDEEP

1536:jXqf0rC+5mjjWb8XN3aBQ+PJ+KeiCX87VwNo:jXqJ4qjX6PgPs7+N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14548d9fd5e154164fbafb0a7ebc8afc

Files

14548d9fd5e154164fbafb0a7ebc8afc
.dll windows:9 windows x86 arch:x86

5afa450aaf6da22a34c20d0ab17256a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

UnhookWindowsHookEx
CallNextHookEx
ExitWindowsEx
FlashWindow
WindowFromPoint
KillTimer
DrawFocusRect
PostQuitMessage

kbdero32

ImmSetStatusWindowPos
ILSaveToStream
ILCreateFromPath
ILIsParent
ImmGetDescriptionA
ImmGetContext
ILAppendID
ExtractAssociatedIconExA
ImmLockIMCC
SdbFindFirstMsiPackage_Str
CallCPLEntry16
CtfImmLeaveCoInitCountSkipMode
IsUserAnAdmin
SetPermLayers
CtfImmCoUninitialize
DragQueryPoint
ImmDisableIME
ImmLockClientImc
RegenerateUserEnvironment
FreeIconList
ImmPenAuxInput
ImmGetConversionStatus
PrintersGetCommand_RunDLLA
SdbGetStandardDatabaseGUID
ImmNotifyIME
ILCombine
DoEnvironmentSubstA

advapi32

FreeSid
RegQueryValueExA
ReadEncryptedFileRaw
RegFlushKey
OpenThreadToken
WriteEncryptedFileRaw

kernel32

SetThreadContext
TerminateThread
InterlockedPopEntrySList
CreateNamedPipeA
InterlockedPushEntrySList
WaitForMultipleObjects
CompareStringA
CreateIoCompletionPort
GetNamedPipeHandleStateA
GetEnvironmentVariableA
GetFileTime
ConnectNamedPipe
GetThreadIOPendingFlag
ConvertDefaultLocale
SetFilePointer
CreateFileA
FileTimeToSystemTime
OpenThread
CreateFileMappingA
SetThreadPriority
RegisterWaitForSingleObject
GetModuleHandleA
WaitForSingleObjectEx
SetFilePointerEx
GetStringTypeA
VirtualQueryEx
MapViewOfFile
ReadFile
RegisterWaitForInputIdle
GetSystemDefaultLCID
GetFirmwareEnvironmentVariableA
GetFileAttributesA
UnmapViewOfFile

ole32

CoInitializeSecurity

netapi32

NetShareEnum

ntdll

_aulldvrm

Exports

Exports

CreateProcessNotify
scartver

Sections

.text
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5afa450aaf6da22a34c20d0ab17256a4

Headers

File Characteristics

Imports

user32

kbdero32

advapi32

kernel32

ole32

netapi32

ntdll

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 44KB

.rdata Size: 3KB - Virtual size: 4KB

.data Size: 7KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 43KB - Virtual size: 44KB

.rdata
Size: 3KB - Virtual size: 4KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB