5bace5d66cb29fa728440ed7307cfd0f

Sharing

Copy URL Twitter E-mail

General

Target

5bace5d66cb29fa728440ed7307cfd0f
Size

200KB
MD5

5bace5d66cb29fa728440ed7307cfd0f
SHA1

45f802f11a77f77c34aa6757015a70fe14190edb
SHA256

6cbc9eeddb20b3c568be80b0d6216d2a5bd5d9b2b5cb6988b1f2f724cb9d46e0
SHA512

bd8281f193a15b4b084964ff5a7defdbb4968a7ca59182e09230d2d86c037e8c461f2ccba4f74eb20a176d5971d50fd96bd79e8d2909f74579a418645fbf1993
SSDEEP

3072:uxz5c1z31n6XPb5X8n/3fEJAqxNh9pFNeM6CJLWwV2rZWMirPqwGc0TLY7Mv0wSs:8c1ztI18UWq9XT3JLqaSw90Hn6y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bace5d66cb29fa728440ed7307cfd0f

Files

5bace5d66cb29fa728440ed7307cfd0f
.dll windows:4 windows x86 arch:x86

1853f051c28da8414fb591b38ef802ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

psapi

EnumProcessModules
GetModuleBaseNameW

mfc71u

ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord757
ord3824
ord266
ord2708
ord4301
ord2829
ord2725
ord2531
ord1162
ord1087
ord1079
ord1200
ord314
ord1170
ord1168
ord1192
ord1115
ord371
ord1093
ord1199
ord1197
ord1033
ord315
ord765
ord5562
ord581
ord764
ord762
ord3677
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579

msvcr71

__CxxFrameHandler
_purecall
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
__security_error_handler
free
_except_handler3
memset
getc
fputc
fflush
ftell
fseek
fwrite
fread
fclose
fopen

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
LocalFree
SetProcessPriorityBoost
GetProcessPriorityBoost
GetCurrentProcessId
GetPriorityClass
OpenProcess
Process32FirstW
CloseHandle
WideCharToMultiByte
GetVersionExA
GetSystemTimeAsFileTime
SetPriorityClass

msvcp71

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

cximage

?GetC@CxMemFile@@UAEJXZ
?PutC@CxMemFile@@UAE_NE@Z
?Error@CxMemFile@@UAEJXZ
?Eof@CxMemFile@@UAE_NXZ
?Flush@CxMemFile@@UAE_NXZ
?Size@CxMemFile@@UAEJXZ
?Tell@CxMemFile@@UAEJXZ
?Seek@CxMemFile@@UAE_NJH@Z
?Write@CxMemFile@@UAEIPBXII@Z
?Read@CxMemFile@@UAEIPAXII@Z
?Close@CxMemFile@@UAE_NXZ
??0CxMemFile@@QAE@PAEK@Z
??0CxImage@@QAE@ABV0@_N11@Z
??0CxImage@@QAE@K@Z
?Destroy@CxImage@@QAE_NXZ
??1CxMemFile@@UAE@XZ

js32

JS_ValueToInt32
JS_NewStringCopyZ
JS_EnumerateStub
JS_ConvertStub
JS_ResolveStub
JS_PropertyStub

javascriptparse

?GetPrivate@CJavaScript@@QAEPAXPAUJSObject@@@Z
?GetJavaScript@@YAPAVCJavaScript@@XZ
?SetPrivate@CJavaScript@@QAE_NPAUJSObject@@PAX@Z
?AddClass@CJavaScript@@QAEPAUJSObject@@PAU2@0PAUJSClass@@P6AHPAUJSContext@@0IPAJ3@ZIPAUJSPropertySpec@@PAUJSFunctionSpec@@56@Z
?NewObject@CJavaScript@@QAEPAUJSObject@@PAU2@PAUJSClass@@0@Z

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXABV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?Open@CxIOFile@@QAE_NPBD0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
getdevops

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1853f051c28da8414fb591b38ef802ca

Headers

File Characteristics

Imports

psapi

mfc71u

msvcr71

kernel32

msvcp71

cximage

js32

javascriptparse

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 4KB - Virtual size: 2KB

.text Size: 168KB - Virtual size: 168KB

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 168KB - Virtual size: 168KB