17072d66498a7884ca452d989f9c11b1

General

Target

17072d66498a7884ca452d989f9c11b1
Size

23KB
MD5

17072d66498a7884ca452d989f9c11b1
SHA1

b67d34c4a4eadc3939cfe1dc15bf2f433ee7ff6c
SHA256

dde660f828459682684b73f760fbab52ebecebffe1b13d832cc3de12d2f3ca13
SHA512

5054d5ba241b2acf38144c94249e4d288e1aea6123ea6987a1defa8276af41f3a29cf887918c143112a10e5e6619c50292e554edf1880960323d2e69c2ae496d
SSDEEP

384:OdYFbmwKWaMrugYCp1ii1Z1mr7VPJJGyxSXc:OdeTaZ1C3ii1Z1wPv9uc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17072d66498a7884ca452d989f9c11b1

Files

17072d66498a7884ca452d989f9c11b1
.dll windows:4 windows x86 arch:x86

25e2672ed9e888fe4017e58a4dfa358c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
GetTempFileNameA
GetTempPathA
LocalFree
FreeLibrary
FormatMessageA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcatA
GetSystemDirectoryA
GetShortPathNameA
Sleep
CreateProcessA
lstrcpyA
GetModuleFileNameA
DeleteFileA
CopyFileA
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GetProcAddress
WriteFile
CreateFileA
CloseHandle
GetWindowsDirectoryA
LoadLibraryA

msvcrt

_findnext
_except_handler3
_ftol
fclose
fflush
fwrite
fopen
sprintf
strrchr
free
_findfirst
_initterm
_adjust_fdiv
calloc
malloc
atoi
_unlink
strstr
_access

user32

LoadStringA
SendMessageA
LoadCursorA
SetCursor

advapi32

RegSetValueExA
RegOpenKeyA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown
Private_Destroy
Private_DestroyStream
Private_HandleEvent
Private_Initialize
Private_New
Private_NewStream
Private_Print
Private_SetWindow
Private_Shutdown
Private_StreamAsFile
Private_URLNotify
Private_Write
Private_WriteReady
Stub_Force_Serialize

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25e2672ed9e888fe4017e58a4dfa358c

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

advapi32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB