6effa5b6a3e5bbb1fdafc994cc3e21f6

Sharing

Copy URL Twitter E-mail

General

Target

6effa5b6a3e5bbb1fdafc994cc3e21f6
Size

50KB
MD5

6effa5b6a3e5bbb1fdafc994cc3e21f6
SHA1

0958397cf34b571fa7dc59aa099131d6dac48d1b
SHA256

14faa2a3a1fcbc28b1189c047bd22d5f34f9c705007f3bb52d891d6c3c870f39
SHA512

e3f82a500e7e99194319f726b8f24416a285eca288f2edfff45198c2663734aa0bf913d6957c918190800f95829e34184781f944036da0fc20c24d408ccd2b3c
SSDEEP

768:M2P0008KCTzXaYCgmPMrAQ/USEtaZR9k/Ii2eoN8borv9Ys7So2Bn6Uink:zP9KC3nCgOMrAQcSiaKIixcvesT2B6Zk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6effa5b6a3e5bbb1fdafc994cc3e21f6

Files

6effa5b6a3e5bbb1fdafc994cc3e21f6
.dll windows:4 windows x86 arch:x86

fc2708ef47a37f6345a3c07b1b9f7bdc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ShowWindow
wsprintfA
DefWindowProcA
PostQuitMessage
DispatchMessageA
RegisterClassExA
CreateWindowExA
MoveWindow
SendMessageA
RegisterDeviceNotificationA
GetMessageA
TranslateMessage

advapi32

OpenProcessToken
QueryServiceStatus
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegQueryValueExA

ws2_32

htonl
gethostbyname
gethostname
inet_ntoa

mpr

WNetCloseEnum
WNetOpenEnumA
WNetCancelConnection2A
WNetAddConnection2A
WNetEnumResourceA

msvcrt

free
time
srand
tolower
_strlwr
_stricmp
strcpy
rand
fputs
strstr
_initterm
fgets
fclose
memset
memcmp
strlen
strcat
sprintf
memcpy
_except_handler3
strcmp
strncpy
malloc
_adjust_fdiv
fopen

kernel32

GetDriveTypeA
GetLogicalDrives
FindNextChangeNotification
WaitForMultipleObjects
DeviceIoControl
OpenEventA
CreateThread
ReadProcessMemory
CopyFileA
FindFirstChangeNotificationA
ExitThread
DisableThreadLibraryCalls
FreeLibrary
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
Sleep
WaitForSingleObject
GlobalAlloc
OpenMutexA
OpenProcess
OpenThread
QueueUserAPC
Thread32First
Thread32Next
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemDirectoryA
GetModuleHandleA
lstrlenA
MultiByteToWideChar
SetFileAttributesA
GetFileTime
CreateFileMappingA
MapViewOfFile
GetFileSize
SetFilePointer
SetFileTime
UnmapViewOfFile
RemoveDirectoryA
GetTempFileNameA
MoveFileA
TerminateProcess
GetThreadContext
VirtualAllocEx
WriteProcessMemory
SetThreadContext
ResumeThread
CreateMutexA
GetLastError
WideCharToMultiByte
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetCurrentProcess
WriteFile
DeleteFileA
CloseHandle
CreateFileA
GetTempPathA
ReadFile
GetCurrentProcessId
CreateProcessA
GetVolumeInformationA
GetVersionExA
GetFileAttributesA
lstrcpynA
lstrcatA
GetWindowsDirectoryA
ExitProcess
VirtualFree
VirtualAlloc

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc2708ef47a37f6345a3c07b1b9f7bdc

Headers

File Characteristics

Imports

user32

advapi32

ws2_32

mpr

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 2KB - Virtual size: 2KB