014b62c38bb798448ef849621c133676

General

Target

014b62c38bb798448ef849621c133676
Size

14KB
MD5

014b62c38bb798448ef849621c133676
SHA1

cf661217121eb78bf81a91756421fb4675ba4bb3
SHA256

e87d31d3edec6cbaa1c6294512a0bf8b103c04b1a307645ce0e27082974b71d7
SHA512

5c6c6482d7af301a4b8cd7087e79dd9d2642f0a437afdd7bae7f9e40b8da82ee95bd19fec456e57be2154576197e17df3363085c9cd3b8d050132b82bc6bee0e
SSDEEP

384:6NmSRVhEYyUy1Z6WiTmouqyaZkTADEvUS6NtTB3JDsn:6NBVh/jyCTruq7Z5EvUSCtTB5D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
014b62c38bb798448ef849621c133676

Files

014b62c38bb798448ef849621c133676
.dll regsvr32 windows:4 windows x86 arch:x86

4451abd28bcff0aed5160537c4099183

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

wininet

InternetConnectA
InternetCloseHandle
FtpGetFileA
InternetGetConnectedState
InternetOpenA

mfc42

ord665
ord354
ord6385
ord6010
ord5186
ord5442
ord1979

msvcrt

_stricmp
rand
strrchr
sprintf
srand
strlen
strcat
__CxxFrameHandler
memset
strcpy
_adjust_fdiv
malloc
_initterm
free
_onexit
strcmp
time
__dllonexit

kernel32

FreeLibrary
Sleep
GetWindowsDirectoryA
DeleteFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
GetProcAddress
CreateRemoteThread
GetLastError
GetCurrentProcess
GetCommandLineA
CloseHandle

user32

KillTimer
SetTimer
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage

advapi32

AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

shell32

ShellExecuteA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Dll_JustWorking
Start

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4451abd28bcff0aed5160537c4099183

Headers

File Characteristics

Imports

winmm

wininet

mfc42

msvcrt

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 16KB

.reloc Size: 1024B - Virtual size: 674B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 16KB

.reloc
Size: 1024B - Virtual size: 674B