65a5cecef3040b4686a19618c994c864

Sharing

Copy URL Twitter E-mail

General

Target

65a5cecef3040b4686a19618c994c864
Size

188KB
MD5

65a5cecef3040b4686a19618c994c864
SHA1

b84593261816482132f3c136d253d19ceab8dcda
SHA256

83abf95a518831397ff40fc1b14428a33ec33c1aa0c518709a4399f7643494c2
SHA512

59a1c0da01033af2f7592e23ee1c89b45d632f5c223402d3f045c91628928131f12f8edc8ab88b233621149ca0a1a9dd9e067a96457cf1bfc44e24a00c94a78c
SSDEEP

3072:OKq07IXSQ3Nd4coIDaWXndXD0SIs/P3byUEf0gj5dBtcN2gRvu:OKv7Iii355TEsHbS0gFdoNQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65a5cecef3040b4686a19618c994c864

Files

65a5cecef3040b4686a19618c994c864
.dll windows:4 windows x86 arch:x86

f050b42afb2eb53e07004954adef10d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCreateKeyA
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
QueryServiceStatus
ControlService
StartServiceA
CreateServiceA
OpenProcessToken
RegOpenKeyA
RegEnumKeyA
RegCreateKeyExA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce

user32

CharLowerBuffW

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW

shell32

SHGetFolderPathA

kernel32

DeleteCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
MultiByteToWideChar
TerminateProcess
CreateThread
TerminateThread
CloseHandle
GetVersionExA
CreateProcessA
CreateToolhelp32Snapshot
Process32First
GetLastError
Process32Next
SetLastError
OpenProcess
GetModuleFileNameA
Sleep
OpenMutexA
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReadProcessMemory
GetCurrentProcess
VirtualQueryEx
WriteProcessMemory
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
RaiseException
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
WriteFile
GetStdHandle
LoadLibraryA
HeapSize
GetFileAttributesA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
SetStdHandle
GetLocaleInfoW
GetExitCodeProcess
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

Exports

Exports

InstallService
RundllInstall
RundllUninstall
ServiceMain
UninstallService

Sections

.text
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f050b42afb2eb53e07004954adef10d4

Headers

File Characteristics

Imports

advapi32

user32

psapi

shell32

kernel32

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 128KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 132KB - Virtual size: 128KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 12KB - Virtual size: 9KB