3aa576c2b0a3d946425f1c729efa2af1

Sharing

Copy URL Twitter E-mail

General

Target

3aa576c2b0a3d946425f1c729efa2af1
Size

25KB
MD5

3aa576c2b0a3d946425f1c729efa2af1
SHA1

ea9f20757002c46ef9b696b474c384ee098fd7fe
SHA256

36bfc4ecd24a0a34a631afac99f0d5b7ee804f277c62ccaaa58d5c824261ed79
SHA512

80b543c3087462b753134f5e648ec38e74d3894944965ad15e1dbb89074c8d4eb99534b983f409577e88e3830abfa3667d27f4a22b5c3baf5cdd245caa1365d4
SSDEEP

384:41QOy6IC2Ha/wLJRvWMKlBK1LEhqmOkLmYTT5m3ORU:41QqiHRkBK14htdLmYhRU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3aa576c2b0a3d946425f1c729efa2af1

Files

3aa576c2b0a3d946425f1c729efa2af1
.dll windows:5 windows x86 arch:x86

fb1f2622a5ced7fd96677a16e7b2c579

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

ZwQueryInformationToken
strtoul
ZwQueryInformationProcess
sprintf
ZwSetInformationFile
RtlTimeToSecondsSince1970
ZwOpenEvent
RtlAdjustPrivilege
RtlNtStatusToDosError
ZwDelayExecution
ZwWaitForSingleObject
ZwOpenProcessToken
ZwDuplicateObject
ZwOpenFile
RtlDosPathNameToNtPathName_U
LdrFindEntryForAddress
RtlRandom
ZwAllocateLocallyUniqueId
RtlInitUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
LdrAccessResource
LdrFindResource_U
RtlComputeCrc32
RtlTimeToTimeFields
ZwSetValueKey
ZwCreateKey
RtlIpv4AddressToStringExW
ZwWriteFile
ZwCreateFile
swprintf
wcschr
ZwResumeThread
ZwTerminateThread
RtlPrefixUnicodeString
RtlGetCurrentPeb
ZwSetContextThread
ZwWriteVirtualMemory
ZwGetContextThread
RtlExitUserThread
ZwClose
ZwOpenKey
ZwQueryVolumeInformationFile
ZwQueryValueKey
_allshr
memset

kernel32

BindIoCompletionCallback
GetProcessHeap
HeapFree
GetLastError
HeapAlloc
Sleep
ExitProcess
GetSystemDefaultLangID
GetVersion
CreateProcessW
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime

ws2_32

WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSAStartup
WSACleanup

advapi32

MD5Final
MD5Update
MD5Init

shell32

ShellExecuteExW

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 742B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb1f2622a5ced7fd96677a16e7b2c579

Headers

File Characteristics

Imports

ntdll

kernel32

ws2_32

advapi32

shell32

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 277B

.rsrc Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 742B

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 277B

.rsrc
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 742B