056f2676ccd5175eea7553ec7ea1c29c

Sharing

Copy URL Twitter E-mail

General

Target

056f2676ccd5175eea7553ec7ea1c29c
Size

29KB
MD5

056f2676ccd5175eea7553ec7ea1c29c
SHA1

175ffb7355ba83d0514eef476e849dea59f4eefc
SHA256

345e28fdeb2905c5d90efa4c5d981a36db297f44235047ea4e89229ed6632c92
SHA512

96b20b8340ba63e16f9bc15a732448b4c1e5a8139e17eb7436bb825236c06783ef86f11551158a43a0849290d8a035df5ff819f375184c2e78fd50fb20a7a589
SSDEEP

768:1x7jocZ+gZRh8dyBI3uwzDg9CEDEdgNQmX6:z7ZIu8dhuwXCCuEdN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
056f2676ccd5175eea7553ec7ea1c29c

Files

056f2676ccd5175eea7553ec7ea1c29c
.dll windows:4 windows x86 arch:x86

454cabba966e605a4386f914f3aa6a30

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
GetProcAddress
LoadLibraryA
GetTempPathA
DeleteFileA
ReadFile
ResetEvent
WaitForSingleObject
GetLastError
CreateEventA
SetEvent
ExitProcess
IsBadReadPtr
GetCommandLineA
CreateMutexA
GetCurrentProcessId
OpenProcess
VirtualAlloc
GetModuleFileNameA
VirtualProtectEx
VirtualProtect
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
WriteProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetCurrentProcess
TerminateProcess
CreateFileA
WriteFile
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
GetCurrentThreadId
Sleep

user32

FindWindowA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetWindowThreadProcessId
GetWindowTextA
GetForegroundWindow

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

ws2_32

closesocket

msvcrt

_initterm
malloc
_adjust_fdiv
_strnicmp
_strupr
_stricmp
_strlwr
free
wcslen
strcmp
fopen
fread
sprintf
strcpy
strlen
strstr
memcpy
memset
strcat
??2@YAPAXI@Z
strrchr
fclose

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 153B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

454cabba966e605a4386f914f3aa6a30

Headers

File Characteristics

Imports

kernel32

user32

wininet

ws2_32

msvcrt

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

sdt Size: 512B - Virtual size: 153B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

sdt
Size: 512B - Virtual size: 153B

.reloc
Size: 3KB - Virtual size: 2KB