486a9f6e3df88a9afa2c2589836e5401

Sharing

Copy URL Twitter E-mail

General

Target

486a9f6e3df88a9afa2c2589836e5401
Size

28KB
MD5

486a9f6e3df88a9afa2c2589836e5401
SHA1

1714b1371691fffcd5434dfe9d331529cb4ad058
SHA256

01266dcaf4e008a478d4aa570bd9b9eb4b44e36a78d2e0f210d525223ab0e58b
SHA512

0ab3cd707ef87f629787e90c10c85c3cb32ebd4218ada6fc40cdfc0b467ba6c613109f62c44c0f67fc87d6a427d9aee036368536bfc073efec77a759cd389711
SSDEEP

768:qwBcCSU3ELvVRApHozKRvDYKq3gpCbBBQARQk9yKyJb:7BcCSUULvXAiOEKpCbBBQAR6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
486a9f6e3df88a9afa2c2589836e5401

Files

486a9f6e3df88a9afa2c2589836e5401
.dll windows:4 windows x86 arch:x86

37c4210df3eeb0acc91278b75085c0fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

memcmp
memcpy
strstr
RtlZeroMemory
RtlUnwind
strlen

ws2_32

gethostname
closesocket

kernel32

CloseHandle
CreateFileA
CreateProcessA
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpynA
lstrlenA
IsBadReadPtr
SetLastError
lstrcpyA
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
MapViewOfFile
GetTempPathA
GetTempFileNameA
CreateFileMappingA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
WriteFile

user32

SendMessageA
SetWindowsHookExA
ToAscii
SetTimer
UnhookWindowsHookEx
GetKeyboardState
KillTimer
wsprintfA
RegisterWindowMessageA
CallNextHookEx
FindWindowA
GetWindowThreadProcessId
MapVirtualKeyA

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

ole32

StringFromGUID2

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37c4210df3eeb0acc91278b75085c0fa

Headers

File Characteristics

Imports

ntdll

ws2_32

kernel32

user32

advapi32

ole32

Sections

.text Size: 20KB - Virtual size: 20KB

.bss Size: - Virtual size: 8B

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 748B

.text
Size: 20KB - Virtual size: 20KB

.bss
Size: - Virtual size: 8B

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 748B