065f9de874ca386a578df94fa000017c

Sharing

Copy URL Twitter E-mail

General

Target

065f9de874ca386a578df94fa000017c
Size

1.2MB
MD5

065f9de874ca386a578df94fa000017c
SHA1

d59779e9651942a410ad79e0823a3658cda24466
SHA256

5bf0e00dc589b4464f78c105b016060424a245f0ee6b94f6af8f3f0f053c07ee
SHA512

076a240600b118bf98a664fa7d3cabeda9efb8b91d5a78c23ee9e00d86a1927d55cc43da0f0831199f631ef1e0213109cce05e31155163203b4327b9c689c972
SSDEEP

24576:SgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkkD:SgcIwi5nQ24EreytZ2c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
065f9de874ca386a578df94fa000017c

Files

065f9de874ca386a578df94fa000017c
.dll windows:5 windows x86 arch:x86

cebe3e34ceb35941b3c83de27fd8e026

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

kernel32

GetFileAttributesExW
DeleteFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateMutexW
SetFilePointer
WaitForSingleObject
GetTickCount
GetModuleFileNameW
GetCurrentThreadId
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
Sleep
RaiseException
InterlockedExchangeAdd
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentProcess
GetFullPathNameA
CreateFileA
GetFileSize
FreeLibrary
UnlockFile
LockFile
FormatMessageA
LoadLibraryW
FlushFileBuffers
GetProcAddress
LockFileEx
LoadLibraryA
GetVersionExA
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetThreadLocale
GetACP
GetLocaleInfoA
GetLocaleInfoW
GetTimeZoneInformation
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetConsoleOutputCP
WriteConsoleW
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetModuleHandleA
GetLastError
GetTempPathW
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
GetFullPathNameW
CloseHandle
IsDebuggerPresent
InterlockedExchange
InterlockedCompareExchange
MultiByteToWideChar
GetFileAttributesA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
GetConsoleMode
GetConsoleCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
GetCommandLineA
HeapReAlloc
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
ExitProcess
HeapSize
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHFileOperationW

Exports

Exports

InitEngine
ScanLink

Sections

.text
Size: 757KB - Virtual size: 756KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cebe3e34ceb35941b3c83de27fd8e026

Headers

File Characteristics

Imports

winmm

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 757KB - Virtual size: 756KB

.rdata Size: 370KB - Virtual size: 370KB

.data Size: 10KB - Virtual size: 23KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 38KB - Virtual size: 38KB

.text
Size: 757KB - Virtual size: 756KB

.rdata
Size: 370KB - Virtual size: 370KB

.data
Size: 10KB - Virtual size: 23KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 38KB - Virtual size: 38KB