20aa426a93d53828bd1fa962120a0756

Sharing

Copy URL

Twitter E-mail

General

Target

20aa426a93d53828bd1fa962120a0756
Size

236KB
MD5

20aa426a93d53828bd1fa962120a0756
SHA1

d2c0ed44f81a2d2366c0b7c387344bb4664a9ca2
SHA256

09b108154cf1b32f00b0c66720b8fe7be6b041a9edbe12c03c6d1a3505e84ca6
SHA512

98888513e129fcf9f279680205ffc2ff1d981d20a9910e9b0ab5c82f6ac55ff8e2145745d2a3c7000b7351629b8576c0efc260df24ce690f305cb5ade3d4c4ed
SSDEEP

3072:hG+GfAt5bvgO8THIu7LU0P1UmaVHhXRuh8BZmBcbvcJMmcpLaSYEA:hG+GJ7L1aVHCyA+HzYEA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20aa426a93d53828bd1fa962120a0756

Files

20aa426a93d53828bd1fa962120a0756
.dll windows:4 windows x86 arch:x86

6600a95f8c4100f01a67e71463b1988f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocalTime
GetCurrentProcessId
GetVersion
FindClose
FindFirstFileA
lstrcpynA
Sleep
SetFilePointer
CompareStringA
CompareStringW
RemoveDirectoryA
FindNextFileA
GetShortPathNameA
VirtualQuery
VirtualProtect
SearchPathA
WaitForSingleObject
SetEvent
ResetEvent
SystemTimeToFileTime
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
lstrlenA
GetCurrentProcess
GetCPInfo
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
TerminateProcess
ExitProcess
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
HeapAlloc
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
InterlockedExchange
lstrcmpiA
GlobalAlloc
FlushInstructionCache
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
WriteFile
GetFileAttributesA
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
GetVersionExA
LocalFree
FormatMessageA
GetModuleHandleA
lstrcatA
CreateEventA
QueryPerformanceFrequency
InterlockedDecrement
InterlockedIncrement
lstrcpyA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
lstrcmpA
DeleteFileA
GetProcAddress
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetModuleFileNameA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GlobalUnlock
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetLastError
SetLastError
GlobalLock
MulDiv
GetTickCount
FindResourceA
LoadResource
LockResource
FreeResource
LoadLibraryA
FreeLibrary
CreateFileA
GetFileSize
ReadFile
CloseHandle

user32

MsgWaitForMultipleObjects
ReleaseDC
GetDC
FillRect
GetClientRect
PeekMessageA
TranslateMessage
DispatchMessageA
CharLowerBuffA
GetClassInfoExA
RegisterClassExA
GetDlgItemTextA
IntersectRect
GetWindow
DestroyWindow
IsWindow
SetWindowTextA
CreateWindowExA
SetWindowPos
GetWindowRect
ScreenToClient
MoveWindow
MapWindowPoints
ShowWindow
EnumChildWindows
SendMessageA
CopyRect
GetWindowTextA
DrawTextA
InflateRect
DrawFocusRect
GetPropA
DefWindowProcA
GetClassNameA
GetWindowLongA
BeginPaint
EndPaint
RemovePropA
CallWindowProcA
wsprintfA
MapDialogRect
GetDlgItem
DrawIcon
SetPropA
SetWindowLongA
InvalidateRect
UpdateWindow
GetDesktopWindow
GetSysColor
GetWindowDC
LoadCursorA

gdi32

GetTextExtentPoint32A
SetBkMode
GetStockObject
CreateDCA
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
SaveDC
CreateCompatibleDC
UnrealizeObject
SetMapMode
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
SelectObject
BitBlt
CreateCompatibleBitmap
CreateSolidBrush
DeleteObject
DeleteDC
CreateBitmap
StretchBlt
SetBkColor
SetTextColor
PlayMetaFile
RestoreDC
PatBlt
SetPixel
CreatePatternBrush
CreateRectRgn
SelectClipRgn
SetStretchBltMode
SelectPalette
RealizePalette
CreateDIBitmap
SetMetaFileBitsEx
DeleteMetaFile

advapi32

RegQueryValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

oleaut32

SysFreeString
SysAllocString
SysStringLen
SysReAllocStringLen
SysAllocStringLen

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

BmpCreateBitmap
BmpDrawBitmap
BmpLoadFromFile
CreatePaletteFromFile
ExtractArchive
GetGifGuy
GetSkinManager
GetWindowImage
GifLoadFromFile
InitializeSkin
InitializeSkin2
Is256ColorsSupported
LoadSkinArchive
LoadWindowImageBitmap
ProcessBmpFile
ReleaseGifGuy
ReleaseSkinManager
ReleaseWindowImage

Sections

.text
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6600a95f8c4100f01a67e71463b1988f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

oleaut32

version

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 122KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 920B

.reloc Size: 12KB - Virtual size: 10KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 124KB - Virtual size: 122KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 920B

.reloc
Size: 12KB - Virtual size: 10KB

.rmnet
Size: 60KB - Virtual size: 60KB