3453d54ff9cdf16578b74878a6fd7c6b

Sharing

Copy URL

Twitter E-mail

General

Target

3453d54ff9cdf16578b74878a6fd7c6b
Size

19KB
MD5

3453d54ff9cdf16578b74878a6fd7c6b
SHA1

3397d4840991f8537a511eb3be027c8a89c1050f
SHA256

0e0dc6d1fe31e147fc7908fa8de4bc517b04243f7179fa43dfb60d6f199f6351
SHA512

5660273d8b7e75e14f7be1b503091e8681bd14f058d9fa704e971ae97b62d67dc64bec76af5407dfd71be3dcedaf4e24589f4f915bf9cc694bc481ea48352b84
SSDEEP

384:gFCiLbX8CxjZ8+0XplFuXMHuq6TlFhnrM:g3sC8pXPwMOq6zu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3453d54ff9cdf16578b74878a6fd7c6b

Files

3453d54ff9cdf16578b74878a6fd7c6b
.dll windows:4 windows x86 arch:x86

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegSetValueExA

kernel32

CreateMutexA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OutputDebugStringA
ReleaseMutex
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
malloc
memcpy
sprintf
vfprintf

Exports

Exports

CalcHash
CalcHashW
DynamicImports
GetKernel32
Inject@4
Injecting
IsPatched
IsStarted
Kernel32Base
KernelGetProcAddressEx
LoopInject@4
MapFileToMemory
PatchDLL
Peb
ResolveDynamicImports
__CloseHandle
__ConnectNamedPipe
__CopyFile
__CreateEvent
__CreateFile
__CreateFileMapping
__CreateMailslot
__CreateNamedPipe
__CreateProcess
__CreateRemoteThread
__CreateService
__CreateToolhelp32Snapshot
__DeleteFile
__ExitProcess
__FindResource
__GetCommandLine
__GetCurrentProcessId
__GetFileSize
__GetFullPathName
__GetKernelObjectSecurity
__GetLongPathName
__GetMailslotInfo
__GetModuleFileName
__GetModuleHandle
__GetProcAddress
__GetProcessId
__GetSystemDirectory
__GetTempFileName
__GetTempPath
__GetTickCount
__GetUserNameW
__GlobalAlloc
__GlobalFree
__LoadLibrary
__LoadResource
__LockResource
__MapViewOfFile
__MessageBox
__NtClose
__NtCreateFile
__NtCreateSection
__NtExtendSection
__NtMapViewOfSection
__NtOpenDirectoryObject
__NtOpenFile
__NtOpenSection
__NtUnmapViewOfSection
__ObReferenceObjectByHandle
__OpenEvent
__OpenProcess
__OpenSCManager
__OpenService
__OpenThread
__Process32First
__Process32Next
__ReadFile
__ReadProcessMemory
__RegOpenKey
__RegQueryValueEx
__ResetEvent
__ResumeThread
__RtlAdjustPrivilege
__RtlInitUnicodeString
__RtlNtStatusToDosError
__SHGetFolderPath
__SetEvent
__SetMailslotInfo
__SizeofResource
__Sleep
__StartService
__SuspendThread
__Thread32First
__Thread32Next
__UnmapViewOfFile
__VirtualAlloc
__VirtualAllocEx
__VirtualFree
__VirtualFreeEx
__WaitForSingleObject
__WinExec
__WriteFile
__WriteProcessMemory
__ZwCreateDirectoryObject
__ZwCreateFile
__ZwCreateSection
__ZwLoadDriver
__ZwMakeTemporaryObject
__ZwQueryInformationProcess
__ZwUnloadDriver
___memset
___strlwr
___strupr
___wcslen
___wcsncpy
__atoi
__lstrcpyn
__lstrlen
__mbstowcs
__memcmp
__memcpy
__memset
__puts
__rand
__srand
__sscanf
__strlwr
__strrchr
__strstr
__time
__wcslen
__wcsncpy
__wsprintf
_strchr
advapi32
emul
kernel32
m2
msvcrt
ntdll
shell32
szAutoloadName
szAutoloadPath
szDriverPath
szIsAutoload
user32
xwcslwr

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 708B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 2KB

.rdata Size: 1024B - Virtual size: 900B

.eh_fram Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 708B

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 1024B - Virtual size: 1016B

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 1024B - Virtual size: 972B

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 900B

.eh_fram
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 708B

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 1016B

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 1024B - Virtual size: 972B