60228ce4dda12cd4727a73e534f763cc

Sharing

Copy URL Twitter E-mail

General

Target

60228ce4dda12cd4727a73e534f763cc
Size

22KB
MD5

60228ce4dda12cd4727a73e534f763cc
SHA1

711edd18abf08a5ce435c7454b98bd76f8c0925d
SHA256

58c17ccbee474f44159dfbc7ed566b1b15ecd0f5b0b27014761bdd4ad9f92e0b
SHA512

2971956c777d3d4a0811ec37f93fbeb66ed2955630fb42c6070bd4202d3ff74a456576ea854987b5463f6b83a0e281b1143577b53f749cef6f5a898c3d5f7835
SSDEEP

384:taPW3nHoJgwcVnnp8/VS21Kn2anL9B+f8RQzaCTkO8Jc9oAhF91s2GgT9aWtj:IW3nHEncV6tS21Kn2anLGf8RyjwTJKoi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60228ce4dda12cd4727a73e534f763cc

Files

60228ce4dda12cd4727a73e534f763cc
.dll windows:5 windows x86 arch:x86

cb0eb8a9bb706701926088a36fc84287

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
VirtualProtect
GetCurrentProcess
Sleep
WriteFile
lstrlenA
lstrcmpiW
CreateMutexA
OpenMutexA
GetModuleFileNameA
GetModuleHandleW
CreateFileA
GetFileAttributesA
GlobalFree
CloseHandle
GlobalAlloc
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime

advapi32

RegOpenKeyExA
RegQueryValueExA

msvcr120

strchr
fclose
tmpfile
sprintf
_purecall
memmove
strrchr
strstr
isalnum
fopen
fread
fseek
ftell
printf
_beginthread
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler3
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
?terminate@@YAXXZ
__clean_type_info_names_internal
_strnicmp
atoi
strncmp
_iob
fprintf
strncpy
memchr
??3@YAXPAX@Z
memset
memcpy
malloc
free
??2@YAPAXI@Z
strtok
_strdup

ws2_32

WSACleanup
WSAStartup
gethostbyname
socket
send
recv
htons
connect
closesocket

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z

psapi

GetModuleInformation

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb0eb8a9bb706701926088a36fc84287

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcr120

ws2_32

msvcp120

psapi

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 20KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 20KB

.reloc
Size: 1KB - Virtual size: 1KB