763fa1a7356168b9afa1cf4a265a3a7a

Sharing

Copy URL

Twitter E-mail

General

Target

763fa1a7356168b9afa1cf4a265a3a7a
Size

75KB
MD5

763fa1a7356168b9afa1cf4a265a3a7a
SHA1

ebe967cad1345fd1589fff834981b6e65114f874
SHA256

69a837d2cb27f6b13a1acbcfd5eecf7e20b9d7173b9488153f1189b6e7e8e942
SHA512

3d0d560c049b4ebe37af4249993e259da91fa3900a529ec22d3c53fe31f16a46820b69532743324a34b19d517bf104a2b30de01b402a1d65191df5df31e272bb
SSDEEP

1536:U/uujvOYsobxHJMfASs6BEHcYmp+r6k192cTZMud:UNdsobxHyu6BORucTD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
763fa1a7356168b9afa1cf4a265a3a7a

Files

763fa1a7356168b9afa1cf4a265a3a7a
.dll windows:5 windows x86 arch:x86

67ad03a0f96a30cd52805fb5f371491d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

shutdown
WSAGetLastError
select
ioctlsocket
closesocket
inet_addr
sendto
WSAStartup
__WSAFDIsSet
connect
htons
recv
gethostbyname
socket
send
WSACleanup

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

urlmon

ObtainUserAgentString

kernel32

GetProcAddress
GetTempFileNameA
LoadLibraryA
DeleteCriticalSection
GetVersionExA
CloseHandle
GetTempPathA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
Sleep
CreateEventA
ResetEvent
GetModuleFileNameA
VirtualProtect
CreateThread
GetTickCount
lstrcmpA
IsBadWritePtr
lstrcpynA
GetFileAttributesA
GetEnvironmentVariableA
FindFirstFileA
GetLastError
CopyFileA
SetFileAttributesA
FindClose
OpenEventA
FindNextFileA
CreateRemoteThread
VirtualAllocEx
GetCurrentProcessId
WriteProcessMemory
WaitNamedPipeA
ConnectNamedPipe
ReadFile
CreateProcessA
DisconnectNamedPipe
CreateNamedPipeA
SetNamedPipeHandleState
WaitForMultipleObjects
OpenProcess
InitializeCriticalSection
WriteFile
WaitForSingleObject
FreeLibrary
CreateFileA
lstrcpyA
lstrcmpiA
lstrcatA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
GetCurrentProcess
GetModuleHandleA
FlushInstructionCache
CreateEventW
GetComputerNameExA
GetLocalTime
MultiByteToWideChar
lstrlenW
lstrcatW
WideCharToMultiByte
MoveFileExA
GetOverlappedResult

advapi32

RegQueryInfoKeyA
CryptGetHashParam
RegOpenKeyA
RegEnumValueA
RegCreateKeyA
InitializeSecurityDescriptor
RegSetValueExA
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegCloseKey
RegEnumKeyA
RegCreateKeyExA
CryptExportKey
CryptAcquireContextW
RegDeleteValueA
RegQueryValueExA
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptEncrypt
CryptImportKey

wininet

InternetOpenA
InternetCloseHandle
InternetConnectA
HttpQueryInfoA
InternetTimeFromSystemTimeA
HttpSendRequestA
InternetCrackUrlW
InternetReadFile
InternetConnectW
HttpSendRequestW
HttpOpenRequestW
HttpAddRequestHeadersA
HttpOpenRequestA
InternetOpenW
InternetCrackUrlA

dnsapi

DnsFree
DnsQuery_A

ole32

OleInitialize
CoCreateInstance
OleUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

Init

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67ad03a0f96a30cd52805fb5f371491d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

psapi

crypt32

urlmon

kernel32

advapi32

wininet

dnsapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 1024B - Virtual size: 73KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 1024B - Virtual size: 73KB

.reloc
Size: 4KB - Virtual size: 4KB