6eb72355a007eef2698171251c1f5446

Sharing

Copy URL Twitter E-mail

General

Target

6eb72355a007eef2698171251c1f5446
Size

58KB
MD5

6eb72355a007eef2698171251c1f5446
SHA1

3f455703ebdcf0f6b7703a4e1d90bf2e61bfb27d
SHA256

29a0a1718daee85547798f0628e95521d7c83658ea97f24ca42b341ac3874878
SHA512

890a12aa95f02a23f445a2bc0eb2658b54aed163e563253cd904975da40680ea7dd5feaa0864014f978544fc8ed9e65f56e90d5222455e1f2dd8d3ca56b681ae
SSDEEP

1536:zS7qk6nUwHhUBrH2FkmtaqUqdi4Bmft03m:zFfhKH2WPq04Ift03m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6eb72355a007eef2698171251c1f5446

Files

6eb72355a007eef2698171251c1f5446
.dll windows:5 windows x86 arch:x86

62cc787b4ab7e36f105e7ff2ea99f244

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtDelayExecution
NtCreateTimer
ZwFreeVirtualMemory
NtGetWriteWatch
ZwDebugActiveProcess
NtImpersonateAnonymousToken

kernel32

ReleaseSemaphore
InterlockedExchangeAdd
GetSystemDirectoryW
WaitForMultipleObjects
VirtualAlloc
CreateThread
CreateFileA
GetSystemTime
GetEnvironmentVariableA
WaitForMultipleObjectsEx
SetThreadPriority
lstrcpynW
GetPrivateProfileIntA
MultiByteToWideChar
GetPrivateProfileIntW
HeapFree
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
DeleteFileW
lstrcpynA
GetStringTypeExW
GetVersion
lstrlenA
DeleteCriticalSection
SetWaitableTimer
GetLocalTime
GetEnvironmentVariableW
CloseHandle
GetCurrentDirectoryW
GetCommandLineW
ReadProcessMemory
WideCharToMultiByte
GetCurrentThreadId
MapViewOfFile
GlobalAddAtomW
GetEnvironmentStrings
GetTickCount
OutputDebugStringA

Exports

Exports

CreateProcessNotify
NhpAllocateAndGetInterfaceInfoFromStack
GetOwnerModuleFromTcpEntry
DllClientCleanup
AllocateAndGetIpAddrTableFromStack
InternalGetIpNetTable
relopugc
NTPTimeToNTFileTime
GetInterfaceInfo
DllClientStartup
GetAdaptersInfo
register_icmp
SetIpForwardEntry
CreateIpNetEntry
GetPerAdapterInfo
GetOwnerModuleFromUdpEntry
NotifyRouteChange
DeleteProxyArpEntry
IcmpParseReplies
DeleteIPAddress
InternalSetIfEntry
GetTcpStatistics
GetBestRoute
SetAdapterIpAddress
Icmp6SendEcho2
DeleteIpForwardEntry
GetExtendedTcpTable
SetIpTTL
SetIpNetEntry
NhGetInterfaceNameFromDeviceGuid
GetUdpStatisticsEx
GetBestInterfaceEx

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62cc787b4ab7e36f105e7ff2ea99f244

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

.data Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 53KB - Virtual size: 53KB

.data
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB