0a697ed9fbfb8667904b35e8eaef528f

Sharing

Copy URL

Twitter E-mail

General

Target

0a697ed9fbfb8667904b35e8eaef528f
Size

156KB
MD5

0a697ed9fbfb8667904b35e8eaef528f
SHA1

1865c9254127183a29e679757c01aaeb90ebef27
SHA256

e1710a5dd72483df9363640a8fc0860d1fd4aa79eb852e6628b65d2ad3f577bc
SHA512

aefa48f46838aebd2065db8d15a957e16d4fe0ef55cab1565ec4489e4cf76171c0eb34307649bd5b90fb37cf38cc2cb4ac8bc48815c18f2768258749b5ff24f8
SSDEEP

1536:JvOM8mPhmz9Dw2tiDqS1q4FoksTeeKSGsYf8s4T1FgjThPPGfay2LIB9TF7i/mIl:1pkTpGs/tGIaGTFe/Nlsol97

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a697ed9fbfb8667904b35e8eaef528f

Files

0a697ed9fbfb8667904b35e8eaef528f
.dll regsvr32 windows:4 windows x86 arch:x86

3fa77e56ab7c6a803f05d346447ebc20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

DefWindowProcA
KillTimer
EnumWindows
SystemParametersInfoA
GetWindowThreadProcessId
GetClassNameA
wsprintfA
DispatchMessageA
SetWindowPos
EnumChildWindows
SetTimer
RegisterClassExA
CreateWindowExA
ShowWindow
GetMessageA
TranslateMessage

kernel32

RaiseException
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
SleepEx
GetTickCount
MoveFileExA
CloseHandle
LocalFree
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
GetSystemDirectoryA
GetLocalTime
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcessId
CreateFileA
GetModuleFileNameA
GetFileType
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
WaitForSingleObject
GetLastError
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
ReadFile
SetEndOfFile
GetFileAttributesA
TlsGetValue
SetLastError
TlsFree
SetFilePointer
FlushFileBuffers
SetStdHandle
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
HeapAlloc
HeapFree
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
TlsAlloc
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
GetCommandLineA
GetVersion
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WriteFile
GetCurrentThreadId
TlsSetValue
SetHandleCount

advapi32

CryptGenRandom
CryptReleaseContext
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
CryptAcquireContextA

shell32

StrStrIA

ole32

CoInitialize
CoCreateGuid
CoCreateInstance

oleaut32

VariantInit
SysAllocString
GetErrorInfo

netapi32

Netbios

wininet

InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

rpcrt4

UuidToStringA

shlwapi

SHSetValueA
SHGetValueA

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3fa77e56ab7c6a803f05d346447ebc20

Headers

File Characteristics

Imports

user32

kernel32

advapi32

shell32

ole32

oleaut32

netapi32

wininet

rpcrt4

shlwapi

psapi

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 28KB - Virtual size: 32KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 28KB - Virtual size: 32KB

.reloc
Size: 8KB - Virtual size: 6KB