7b15ea96693a5af324cf033f9fde2fb9

Sharing

Copy URL Twitter E-mail

General

Target

7b15ea96693a5af324cf033f9fde2fb9
Size

51KB
MD5

7b15ea96693a5af324cf033f9fde2fb9
SHA1

30d51ea54ef07f20fd203690e4cb8d2a143c86b2
SHA256

2f965bc70f5c5ed4a75546e67083863bceb0abda815987e7038e83db521bf3be
SHA512

fa665a073c8f0a27d7ad9b93d8014822b4b1278be60e10378ba387d755fb0676c2852feedfbe4e87b94ee0be75c617f95b9c947529df8f9dbe2d3206d851b92c
SSDEEP

1536:6TpBP+ZTM8xRgLPjWg90BL/mkJ8BOpIBHuEgcin9:6Ty68xRqPjWLL+kCLRrgci

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b15ea96693a5af324cf033f9fde2fb9

Files

7b15ea96693a5af324cf033f9fde2fb9
.dll windows:5 windows x86 arch:x86

5b599bc8d707bdd481c49a2905f92728

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

ZwFlushVirtualMemory
NtOpenMutant
ZwFlushKey

shlwapi

PathIsRelativeW
PathAppendA
PathFileExistsW
StrToIntW
ord29
StrToIntExW
PathCanonicalizeW
PathStripPathW

kernel32

GlobalDeleteAtom
FreeResource
LocalAlloc
SetUnhandledExceptionFilter
InterlockedIncrement
CloseHandle
FindFirstFileA
GetStringTypeExA
GlobalUnlock
GetLastError
GetVersionExW
InterlockedIncrement
VirtualAlloc
LocalFree

gdi32

GetNearestColor
GetDeviceCaps
SetPixel
CombineRgn

user32

LoadAcceleratorsA
SendMessageTimeoutA
LoadIconA
ShowCursor
ReplyMessage
GetWindowThreadProcessId
EnumThreadWindows
GetDlgItemTextW
DialogBoxParamW
BringWindowToTop
GetSysColorBrush
SendMessageCallbackA
SystemParametersInfoW
MessageBoxW
GetMenuStringW
SetWindowTextW
ChildWindowFromPoint
FillRect
CharPrevA
DialogBoxIndirectParamW
SetCapture
GetClassInfoW

Exports

Exports

IpReleaseAddress
CreateProcessNotify
DllClientCleanup
GetOwnerModuleFromUdpEntry
IcmpCreateFile
NhGetInterfaceNameFromGuid
SetIpStatistics
findokup
GetIcmpStatisticsEx
RestoreMediaSense
CreateIpNetEntry
DllClientStartup
DisableMediaSense
GetNetworkParams
do_echo_rep
InternalGetIfTable
DeleteProxyArpEntry
SetAdapterIpAddress
InternalSetTcpEntry
GetBestInterface
InternalCreateIpForwardEntry
NhpAllocateAndGetInterfaceInfoFromStack
IcmpSendEcho2
GetUdpStatisticsEx
NhGetGuidFromInterfaceName
AddIPAddress
DeleteIPAddress
Icmp6SendEcho2
SetIpForwardEntry
DeleteIpForwardEntry
GetNumberOfInterfaces
InternalDeleteIpNetEntry
InternalGetIpAddrTable
IcmpParseReplies
GetIpStatistics
SetTcpEntry
NTPTimeToNTFileTime
GetExtendedUdpTable
Icmp6CreateFile
InternalGetUdpTable
SetIpNetEntry
InternalSetIpStats
GetTcpTable
InternalSetIfEntry
GetUdpStatistics
GetIpAddrTable
IpRenewAddress
EnableRouter
AllocateAndGetIpAddrTableFromStack
do_echo_req
UnenableRouter
GetBestRoute
InternalGetTcpTable
GetAdaptersAddresses
InternalDeleteIpForwardEntry
SetIpTTL
GetAdapterIndex
NotifyAddrChange
SetIfEntry
GetIpNetTable
CancelIPChangeNotify
GetIpStatisticsEx
SendARP
InternalGetIpForwardTable
GetAdaptersInfo
register_icmp
NTTimeToNTPTime
GetPerAdapterInfo
GetFriendlyIfIndex
GetAdapterOrderMap
GetIfTable
GetInterfaceInfo
NhGetInterfaceNameFromDeviceGuid
FlushIpNetTable
InternalSetIpNetEntry
IcmpSendEcho
GetOwnerModuleFromTcpEntry
GetExtendedTcpTable
IcmpCloseHandle
GetRTTAndHopCount
GetIpErrorString
GetBestInterfaceEx

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b599bc8d707bdd481c49a2905f92728

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

kernel32

gdi32

user32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 39KB

.data Size: 10KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 39KB - Virtual size: 39KB

.data
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB