5e22e7cb23555ae8fcee974cfb1c225a

General

Target

5e22e7cb23555ae8fcee974cfb1c225a
Size

30KB
MD5

5e22e7cb23555ae8fcee974cfb1c225a
SHA1

f93955061cc9a2b7869086d74bba016232183ce9
SHA256

f00d97b0d69fbecacd93ac33adf05e14321d1da60d058492c3845bf5e2a25b7b
SHA512

0b335b92882bbe3e172e9ca7cdf36d5853516daa2bd6a13dcb785e1b582bd198b9a86361d26e8e01b0108c6fb3f5ac5b3baf4d79dda8a33ecd2ea479a87a7e32
SSDEEP

768:OxlbqbcHODGkadDsiTcFwNMN+TQbkUeB:Ox4bNGksMN+7UeB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e22e7cb23555ae8fcee974cfb1c225a

Files

5e22e7cb23555ae8fcee974cfb1c225a
.dll windows:4 windows x86 arch:x86

f81615c7e59dc392a4017292ec16a80d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
Process32Next
DeleteFileA
GetVersionExA
OpenProcess
lstrcpyA
lstrcatA
SetEvent
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
CloseHandle
GetTempFileNameA
GetFileAttributesA
FindClose
CreateFileA
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
ReleaseMutex
CreateEventA
CreateMutexA
CreateThread
lstrcmpA
ResetEvent
CompareStringA
SetEndOfFile
SetFilePointer
Process32First

user32

wsprintfA
CharUpperA

advapi32

CryptDecrypt
SetSecurityDescriptorDacl
CreateProcessAsUserA
RegSetValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptEncrypt
CryptDeriveKey
CryptHashData
OpenProcessToken
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptCreateHash
CryptAcquireContextA
InitializeSecurityDescriptor

wininet

InternetGetConnectedState
InternetOpenA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetConnectA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f81615c7e59dc392a4017292ec16a80d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

iphlpapi

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB