00e0b32fc38cbdc0d380faf1417e0064

Sharing

Copy URL

Twitter E-mail

General

Target

00e0b32fc38cbdc0d380faf1417e0064
Size

72KB
MD5

00e0b32fc38cbdc0d380faf1417e0064
SHA1

a9491b3e9b664e2126a0c9205b8db4f1937a4c5f
SHA256

e258ac027d9071413bc151de3381428e9e34a0cc2a4b5bce65e172474318bf00
SHA512

9bd3ccddb249f3a12fe860b65c67c6b739ddf09d4f422f441bda7d160750d6d433df0528d9e2ff6ce70b00721eacbc612d9859576833d587da60fc094d636a60
SSDEEP

1536:tt8fYBegtf7hmgVKYSf7xP2rUX9lZqLYLkEiiRzB8JW3x9qYU:ttT/f7hmgVKYSf7wskEiKB8JWfJU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00e0b32fc38cbdc0d380faf1417e0064

Files

00e0b32fc38cbdc0d380faf1417e0064
.dll windows:5 windows x86 arch:x86

9c99f0d16b283ec3b3c732a1fcb91d89

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExA
RegEnumValueA

kernel32

GetLastError
WriteFileEx
PurgeComm
lstrlenA
InitializeCriticalSection
lstrcpyA
HeapAlloc
LeaveCriticalSection
HeapFree
lstrcmpA
EnterCriticalSection
lstrcatA
DeleteCriticalSection
CloseHandle
SetFilePointer
GetFileSize
WriteFile
CreateFileA
SetEndOfFile
ReadFile
GetLocalTime
GetSystemDirectoryA
GetCommModemStatus
GetTickCount
GetCommConfig
SetCommState
GetCommState
Sleep
WaitForSingleObjectEx
SetEvent
GetOverlappedResult
SetCommMask
EscapeCommFunction
HeapDestroy
FreeLibrary
LoadLibraryA
DisableThreadLibraryCalls
GetProcessHeap
HeapCreate
HeapReAlloc
SetCommConfig
DuplicateHandle
GetCurrentProcess
ResetEvent
CreateEventA
CreateFileW
lstrcatW
lstrlenW
lstrcpyW
GetCommProperties
GetDefaultCommConfigA
GetProcAddress
WaitForSingleObject
SetupComm
ReadFileEx
lstrcmpiA
SetCommTimeouts
ClearCommError
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

ntdll

isxdigit
RtlUnwind
NtQueryVirtualMemory
memmove
isprint
isdigit
_alloca_probe
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
_chkstk
toupper

user32

wsprintfA
LoadStringA
wvsprintfA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

uniplat

ord108
ord107
ord113
ord109
ord106
WinntIsWorkstation
ord116
ord104
ord115
ord110
ord105
ord100
ord101
ord111
ord213
ord212
ord114

Exports

Exports

UmAbortCurrentModemCommand
UmAnswerModem
UmCloseModem
UmDeinitializeModemDriver
UmDialModem
UmDuplicateDeviceHandle
UmGenerateDigit
UmGetDiagnostics
UmHangupModem
UmInitModem
UmInitializeModemDriver
UmIssueCommand
UmLogDiagnostics
UmLogStringA
UmMonitorModem
UmOpenModem
UmSetPassthroughMode
UmSetSpeakerPhoneState
UmWaveAction

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c99f0d16b283ec3b3c732a1fcb91d89

Headers

File Characteristics

Imports

advapi32

kernel32

ntdll

user32

version

uniplat

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 48KB - Virtual size: 47KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 2KB - Virtual size: 2KB