649b8dc9050c30dead32a6c3fb2f27db

Sharing

Copy URL Twitter E-mail

General

Target

649b8dc9050c30dead32a6c3fb2f27db
Size

268KB
MD5

649b8dc9050c30dead32a6c3fb2f27db
SHA1

96c4873bf68068035c98e8f2bd023525d7d3f1fb
SHA256

e59cc3f4e20aa701a3413ff519ea88167b6160a191942c502f3cb0fcd5f26c5f
SHA512

c1f2492779cc2bcfeef38f451600707accb96d8517ac1ab32b00868a9991cb5e1db5f51ff8a74d2133422cd89db99f55a465a9ca7fe98120a58471ee515e3dbe
SSDEEP

6144:mt2q/XGslJQa2dquoGi5V5/1ntj8jBh55sE/S:3s/2dqz5XjEB3t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
649b8dc9050c30dead32a6c3fb2f27db

Files

649b8dc9050c30dead32a6c3fb2f27db
.dll windows:4 windows x86 arch:x86

3dc7fa400e410ba2c0f11ebd53f76d1d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateSemaphoreA
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapSize
HeapValidate
HeapWalk
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
CreateFileMappingA
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
OpenFileMappingA
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlUnwind
SetEndOfFile
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualFree
WaitForMultipleObjects
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
CreateFileA
CreateEventA
InterlockedCompareExchange
CloseHandle

ws2_32

socket
send
closesocket
WSAStartup
WSAGetLastError
recv
ioctlsocket
inet_addr
htons
gethostbyname
connect
gethostbyaddr

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

user32

MessageBoxA

Exports

Exports

AddDataToImageItem
BindTexture2D
CopyClickWBCoefs
CreateFolder
EnumDeviceReset
EnumRelCamSettingReset
GetAFDistanceSettingCount
GetDevice
GetDiscErasingTime
GetExposureComp
MallocPitch
RegisterFatBinary
UnbindTexture
WGLGetDevice

Sections

.text
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3dc7fa400e410ba2c0f11ebd53f76d1d

Headers

File Characteristics

Imports

kernel32

ws2_32

advapi32

setupapi

user32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 172KB

.data Size: 84KB - Virtual size: 108KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 172KB - Virtual size: 172KB

.data
Size: 84KB - Virtual size: 108KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB