69cbbf3e88f427140d1e8c75aadcd823

General

Target

69cbbf3e88f427140d1e8c75aadcd823
Size

44KB
MD5

69cbbf3e88f427140d1e8c75aadcd823
SHA1

1875e8dfca76636c9be71eae9fb0b035459a1cb8
SHA256

6d9d076b7868f26ca4f57fe2511ecd47e20eb9b20a5b0b9632fbe415755b11f2
SHA512

edc1299306ff005ff84ac3e2b0f2a325c2f61b9b7b5ca8e49a7d4367ddd22f64abcae24eab46620e94c2b2ec3161004b7834922660937f74276825833bb2ff5a
SSDEEP

768:NBwrjM3+3F7sEs0w7Y9htyxgU1sy/A5wOgW3fBBQARQk56sA:NWwu1M0wkr6OgW3fBBQAR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69cbbf3e88f427140d1e8c75aadcd823

Files

69cbbf3e88f427140d1e8c75aadcd823
.dll windows:4 windows x86 arch:x86

86e9be111e8b68c387df361d7f4e7774

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlZeroMemory
RtlUnwind
_snprintf
strstr
memcmp
memcpy
strlen

ws2_32

gethostname
closesocket

kernel32

DeleteFileA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
MapViewOfFile
LoadLibraryA
IsBadReadPtr
lstrcpyA
lstrcpynA
lstrlenA
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
CreateFileA
CreateFileMappingA
CreateProcessA
GetTempPathA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
GetSystemDirectoryA
GetTempFileNameA

user32

wsprintfA
UnhookWindowsHookEx
SetWindowsHookExA
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
FindWindowA
CallNextHookEx
PostMessageA
GetWindowThreadProcessId
GetParent
GetWindowTextA
EnumWindows

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86e9be111e8b68c387df361d7f4e7774

Headers

File Characteristics

Imports

ntdll

ws2_32

kernel32

user32

Sections

.text Size: 28KB - Virtual size: 25KB

.bss Size: - Virtual size: 12B

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 25KB

.bss
Size: - Virtual size: 12B

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 1KB