30e7ac23ab468eb561baa1c566b4c3ae

Sharing

Copy URL Twitter E-mail

General

Target

30e7ac23ab468eb561baa1c566b4c3ae
Size

45KB
MD5

30e7ac23ab468eb561baa1c566b4c3ae
SHA1

0f975b044769cdf5f8a27cbc20b122689a0d7f8b
SHA256

786f973ad9c578308b2ad2f88514b77e86845718202673bcb48619ad67eca43f
SHA512

dfdca0a2160cc26a57d24d601a1078c4b746a91b2efcbeaa382892eb5428c3b8b3bf884e854e7ba19e8e57d4ed3b9a4541d21a5dafecf12b4b7311f8b6faf2b8
SSDEEP

768:FMAzGDGwmMG1JwYqrD8PDwYzdWwkCZvLDTqUhHE6/OjLRgTB+oG0oX:yAzGiwm3TE8PDtJPLSUhEWOXO0zv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30e7ac23ab468eb561baa1c566b4c3ae

Files

30e7ac23ab468eb561baa1c566b4c3ae
.dll windows:4 windows x86 arch:x86

2560b5140828344cf773496b06116ec9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
GetCurrentProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
Process32Next
lstrcmpiA
Process32First
WriteFile
lstrcatA
GetTickCount
FindClose
FindFirstFileA
OpenProcess
GetTempPathA
GetWindowsDirectoryA
ReleaseMutex
GetLastError
CreateMutexA
FreeLibrary
GetFileAttributesA
MoveFileExA
DeleteFileA
lstrcpynA
ReadProcessMemory
SetThreadPriority
DeviceIoControl
TerminateThread
CopyFileA
GetSystemDirectoryA
GlobalAlloc
GlobalFree
SetEndOfFile
VirtualAlloc
VirtualFree
TerminateProcess
GetModuleHandleA
CreateFileA
ReadFile
SetFilePointer
CloseHandle
GetFileSize
LoadLibraryA
GetProcAddress
CreateThread
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringA
GetModuleFileNameA
Sleep

user32

PostMessageA
wsprintfA
FindWindowA
wsprintfW
GetForegroundWindow
GetWindow
GetClassNameW

gdi32

GetDeviceCaps
CreateCompatibleDC
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateDCA
CreateCompatibleBitmap

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA

msvcrt

_onexit
__dllonexit
_strcmpi
_strupr
_strdup
srand
memset
??2@YAPAXI@Z
strcpy
strcat
strrchr
wcsncpy
strstr
strlen
free
_stricmp
strncpy
malloc
memcpy
??3@YAXPAX@Z
_except_handler3
_strlwr
wcscat
wcscpy
wcslen
isspace
isalnum
strchr
_vsnprintf
realloc
isdigit
isalpha
atoi
wcscmp
mbstowcs
wcsncat
wcsstr
exit
rand

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

gethostbyname
closesocket
recv
connect
htons
socket
WSAStartup
shutdown
send

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

pfjaoidjglkajd

Sections

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2560b5140828344cf773496b06116ec9

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

gdiplus

msvcp60

wsock32

psapi

Exports

Exports

Sections

.bss Size: - Virtual size: 3KB

.data Size: 40KB - Virtual size: 40KB

.CRT Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.data
Size: 40KB - Virtual size: 40KB

.CRT
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 2KB