312e13a83329356f7fcefc2e3b14d9de

Sharing

Copy URL Twitter E-mail

General

Target

312e13a83329356f7fcefc2e3b14d9de
Size

63KB
MD5

312e13a83329356f7fcefc2e3b14d9de
SHA1

f69687902def66cffd095c70b12433d6743997be
SHA256

cf284a7c887ce66fb93e924c440830a272eff49361280e97915a1959fab05e34
SHA512

856a1a7c28293c73a381f4f716020c3468ba44b4527e27fce1411bc8b5063e694d406e1d729c4ca1e606add1513b940397ba598cc281342b921d291b479a1217
SSDEEP

1536:MUDkh6obZli3WXBVIMVZIxI+XWtU12DvhE75cqwFwhdl9OeJWmhgd:MUDkh6odlkWXBVIMaXWtUEFpqVB9zh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
312e13a83329356f7fcefc2e3b14d9de

Files

312e13a83329356f7fcefc2e3b14d9de
.dll windows:1 windows x86 arch:x86

d036cd2f857eee7e3ffcdadf7167b16e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSAAsyncSelect
WSACleanup
WSAStartup
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getsockname
htons
inet_addr
inet_ntoa
listen
recv
send
sendto
socket

wininet

InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetOpenUrlA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA

shell32

ShellExecuteA

kernel32

ExitProcess
ExpandEnvironmentStringsA
GetComputerNameA
GetEnvironmentStringsA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
CloseHandle
GetTickCount
GetVersionExA
GlobalMemoryStatus
LoadLibraryA
RtlUnwind
CreateFileA
Sleep
TerminateThread
WriteFile
CreateProcessA
CreateThread

advapi32

GetUserNameA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

crtdll

_fdopen
_iob
_itoa
_open_osfhandle
_strnicmp
atoi
exit
fclose
fputc
_cexit
localeconv
malloc
memcpy
memmove
memset
pow
raise
rand
setbuf
srand
strcat
strchr
strcmp
strncmp
strncpy
strstr
strtok
strtol
wcslen
wctomb

Exports

Exports

_LibMain@12

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 93KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 84B - Virtual size: 84B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE

.edata
Size: 80B - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d036cd2f857eee7e3ffcdadf7167b16e

Headers

File Characteristics

Imports

wsock32

wininet

shell32

kernel32

advapi32

crtdll

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 48KB

.bss Size: - Virtual size: 93KB

.rdata Size: 84B - Virtual size: 84B

.data Size: 6KB - Virtual size: 6KB

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.edata Size: 80B - Virtual size: 80B

.text
Size: 48KB - Virtual size: 48KB

.bss
Size: - Virtual size: 93KB

.rdata
Size: 84B - Virtual size: 84B

.data
Size: 6KB - Virtual size: 6KB

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

.edata
Size: 80B - Virtual size: 80B