414ca6558f1d72952de3444ded14184b

Sharing

Copy URL Twitter E-mail

General

Target

414ca6558f1d72952de3444ded14184b
Size

52KB
MD5

414ca6558f1d72952de3444ded14184b
SHA1

2e53b8c6d35331a1d15074dce329459945379e11
SHA256

e789ad8efa2093496ac880e4571022a717161f26796f22373fd1fd11f499b355
SHA512

56c804bef8e62ded5ee1881b9b352f71aca7b7ad7f2ca677ef8f0f0bbf4626dd23e6ec44575dd95afed07e49afbf4f386b83d02ead75c7e44b2f271fc23e8b24
SSDEEP

768:ecWOd5LJjkj/b9uyyUcNXpCDPQlqKY69CJi1r/bTQ9qJp:eELJjob9uyyUcNXpkPQly68wlp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
414ca6558f1d72952de3444ded14184b

Files

414ca6558f1d72952de3444ded14184b
.dll windows:1 windows x86 arch:x86

5a1fb0df104a9ea7b0de8d8bc40be0cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

cw3220mt

_sprintf
_memchr
_strlen
_strcat
_memset
_memcmp
_time
_strncmp
_strcmp
_strchr
_realloc
_rand
_memmove
_memcpy
_vsprintf
_vfprintf
_strstr
_strncpy
_strerror
_strcpy
@_CatchCleanup$qv
@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__ErrorMessage
__ExceptionHandler
___debuggerDisableTerminateCallback
__free_heaps
__startup
__startupd
_abort
_calloc
_ctime
_fclose
_flushall
_fopen
_fprintf
_free
_heapcheck
_malloc

kernel32

InitializeCriticalSection
GlobalMemoryStatus
GetEnvironmentVariableA
GetVersion
GetProcAddress
GetCurrentThreadId
CreateFileA
GetModuleHandleA
WriteFile
VirtualQuery
GetModuleFileNameA
GetCurrentProcessId
VirtualFree
VirtualAlloc
GetLastError
SetFilePointer
LeaveCriticalSection
GetFileAttributesA
EnterCriticalSection
CreateDirectoryA
CloseHandle

Exports

Exports

@MemCmp1
@MemCmp4
@MemCmp8
BInsert
CP1250_NTo_UTF16
CP1250_NTo_UTF8
CP1250_To_UTF16
CP1250_To_UTF8
CheckExFileNameForPth
CheckFileNameForCodePage
CheckFileNameForPth
CheckIsMask
CheckIsPath
CheckMaskNameForPth
CheckPtr
CleanMazowiaToWindows
CleanWindowsToMazowia
CrcTmpPsw
DoneStatistics
ExUpdateMiscStatistics
FillHomeDir
GenerateTmpPsw
GetMazowiaToWindowsChar
GetMazowiaToWindowsWithFramesChar
ISO_8859_2ToMazovia1Ex
ISO_8859_2ToMazoviaEx
InfoNdxMem
InitStatistics
IsKBAlloc
MAZOVIA_NTo_UTF16
MAZOVIA_NTo_UTF8
MAZOVIA_To_UTF16
MAZOVIA_To_UTF8
MSaveStack
MSaveSystemError
MazoviaToISO_8859_2_1Ex
MazoviaToISO_8859_2_Ex
MazoviaToWindowsMultiLine
MazowiaToWindows1Ex
MazowiaToWindowsEx
MazowiaToWindowsWithFrames1Ex
MazowiaToWindowsWithFramesEx
MemCmp
NMazowiaToWindowsEx
NMazowiaToWindowsWithFramesEx
NWindowsToMazowiaEx
NWindowsToMazowiaExNl
NWindowsToMazowiaWithFramesEx
OnNewThreadStatistics
OpNdxMemFree
OpNdxMemGet
OpNdxMemPageGet
ReadUserNoFromTmpPsw
RegisterSortThreadIdForStatistics
SaveEndSort
SaveStackC
SaveStackToFileC
SaveStartSort
SaveUserLogStatistics
SetErrorLogName
SetErrorLogNameToHome
SetErrorProgName
StackToMemoryC
StrAlloc
StrChr
StrCmp
StrCmpI
StrCmpIS
StrCmpNoCaseSensitive
StrLwr
StrNCmp
StrStr
StrUpr
UTF16_NTo_CP1250
UTF16_NTo_MAZOVIA
UTF16_NTo_UTF8
UTF16_To_CP1250
UTF16_To_MAZOVIA
UTF16_To_UTF8
UTF8_NTo_CP1250
UTF8_NTo_MAZOVIA
UTF8_NTo_MAZOVIA_With_Callback
UTF8_NTo_UTF16
UTF8_To_CP1250
UTF8_To_MAZOVIA
UTF8_To_UTF16
UpdateCommandStatistics
UpdateIdleCycle
UpdateMiscStatistics
UpdateWorkCycle
WindowsToMazowia1Ex
WindowsToMazowiaEx
WindowsToMazowiaWithFrames1Ex
WindowsToMazowiaWithFramesEx
_BSearch
_CFGetOnOff
_CFSetOnOff
_CharCmpTab
_CharOgonekTab
_CharTypeTab
_CheckFileNameForPth
_CheckHeap
_ConvertMazowiaToWindows
_DiffPTSCounter
_FromMazowiaToWindows
_FromMazowiaToWindowsWithFrames
_FromWindowsToMazowia
_FromWindowsToMazowiaWithFrames
_InfoMemFunc
_JavaUTF8ToMacroString
_MacroStringNCopy
_MacroStringToJavaUTF8
_MacroStringToSystem
_MacroStringToWindows
_NJavaUTF8ToMacroString
_NWindowsToMacroString
_ReadPTSCounter
_SHA1Input
_SHA1Reset
_SHA1Result
_SafeStringCopy
_SaveToLog
_TableCrc32
_TableCrc32Con
_TableCrc32End
_ToLowerTab
_ToUpperTab
_WindowsToMacroString
__AddDebugInfo
__DebuggerHookData
__FromMazowiaToWindows
_snprintf
_vsnprintf
int8Add
int8AddInt
int8CastInt
int8Cmp
int8CmpZero
int8Div
int8DivAndModInt8
int8DivInt8
int8Mod
int8Mul
int8Neg
int8RShift
s_GetMemoryZeroInit
s_MemFree
s_MemGet
s_MemRealloc

Sections

CODE
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a1fb0df104a9ea7b0de8d8bc40be0cb

Headers

File Characteristics

Imports

cw3220mt

kernel32

Exports

Exports

Sections

CODE Size: 34KB - Virtual size: 36KB

DATA Size: 9KB - Virtual size: 12KB

.idata Size: 1KB - Virtual size: 4KB

.edata Size: 4KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

CODE
Size: 34KB - Virtual size: 36KB

DATA
Size: 9KB - Virtual size: 12KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB