602fcba267e9d6d8dbcdce143fdbf168

Sharing

Copy URL Twitter E-mail

General

Target

602fcba267e9d6d8dbcdce143fdbf168
Size

64KB
MD5

602fcba267e9d6d8dbcdce143fdbf168
SHA1

cdbad3a4c57f001489748c745c79c75a6c612d1d
SHA256

6b93a7b837b9be92b52501a5a9a10316d987b1e98640bd9feec896d6a994c7ba
SHA512

8191abe435440e2504508df47ae7763aaecdd9ae009a050d2714e56bbb747da946c25076cd137853e5faf34bf954233edf8d1ccfbcc954bcd59bc89bf8922300
SSDEEP

768:xyBhefqBs/VCaVINp7dRqQA+NIAJueU4gcABBQARQkvueN39Yse4xort:xyBheSQCcwieU4gvBBQARzw4x0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
602fcba267e9d6d8dbcdce143fdbf168

Files

602fcba267e9d6d8dbcdce143fdbf168
.dll windows:4 windows x86 arch:x86

b26e4702d78ed86b0e45871d0321c205

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

memcmp
memcpy
strlen
strstr
_snprintf
RtlZeroMemory
RtlUnwind

ws2_32

closesocket
gethostname

kernel32

lstrcmpA
GetLastError
GetFileSize
GetExitCodeThread
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
CloseHandle
CreateProcessA
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpynA
lstrlenA
IsBadReadPtr
DeleteFileA
lstrcpyA
CreateFileMappingA
CreateFileA
GetTempFileNameA
GetTempPathA
MapViewOfFile
GetStartupInfoA

user32

SetTimer
ToAscii
GetKeyboardState
KillTimer
GetWindowThreadProcessId
FindWindowA
wsprintfA
UnhookWindowsHookEx
CallNextHookEx
RegisterWindowMessageA
SendMessageA
MapVirtualKeyA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.luma0
Size: 4KB - Virtual size: 738B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.luma1
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b26e4702d78ed86b0e45871d0321c205

Headers

File Characteristics

Imports

ntdll

ws2_32

kernel32

user32

Sections

.text Size: 24KB - Virtual size: 23KB

.bss Size: - Virtual size: 12B

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.luma0 Size: 4KB - Virtual size: 738B

.luma1 Size: 20KB - Virtual size: 16KB

.reloc Size: 4KB - Virtual size: 756B

.text
Size: 24KB - Virtual size: 23KB

.bss
Size: - Virtual size: 12B

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.luma0
Size: 4KB - Virtual size: 738B

.luma1
Size: 20KB - Virtual size: 16KB

.reloc
Size: 4KB - Virtual size: 756B