086efb991e2932062e16655cd4d2170c

Sharing

Copy URL

Twitter E-mail

General

Target

086efb991e2932062e16655cd4d2170c
Size

29KB
MD5

086efb991e2932062e16655cd4d2170c
SHA1

9f7d96c4f1c37cb1ccecee695b86a56b0612de58
SHA256

58c53f94788e9d6e67ddc809b5e000051e8efd48a29308520e5ad21ca61e8af5
SHA512

3d35b3fa0b492c6dc97fa7e564e59f0d00fab9636af20f54e0b28765e0aaafdaa15652bb60f90d1bf7a471ad575d5204f8d8c83350218206b89b118f9f211904
SSDEEP

384:IaNv3Dx1V+NxlYz5bnNksf2Z7hOHsy9Njw2deqzCm4HCiCIAfGCHT7UWn3tWO/:xvTxKNx6cVZly9Njwieqz6CjTnHTB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
086efb991e2932062e16655cd4d2170c

Files

086efb991e2932062e16655cd4d2170c
.dll windows:4 windows x86 arch:x86

20d8715cd4d48a50971942011ec1ad34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
GetEnvironmentVariableW
FreeLibrary
GetProcAddress
LoadLibraryA
GetComputerNameA
TerminateProcess
Module32Next
Module32First
ReadFile
PeekNamedPipe
lstrcpynA
Process32Next
WaitForMultipleObjects
TerminateThread
CreateThread
GetDiskFreeSpaceExA
GetVolumeInformationA
GetDriveTypeA
GetSystemDefaultLangID
GetTickCount
GlobalMemoryStatus
MultiByteToWideChar
SetCurrentDirectoryA
WaitForSingleObject
GetCurrentDirectoryA
lstrlenA
lstrcatA
WideCharToMultiByte
MoveFileA
DisconnectNamedPipe
DeleteFileA
lstrcpyA
FindFirstFileA
FindNextFileA
CreatePipe
CloseHandle
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
OpenProcess
GetSystemInfo
ReadProcessMemory
VirtualQueryEx
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapFree
GetVersionExA
GetCurrentProcess
GetLastError
WriteFile

user32

wsprintfA
ExitWindowsEx

gdi32

GetDeviceCaps
DeleteDC
CreateDCA

advapi32

ClearEventLogA
SetServiceStatus
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenEventLogA
CloseEventLog
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegisterServiceCtrlHandlerA

shell32

SHFileOperationA

msvcrt

_strnicmp
_stricmp
_wcsicmp
printf
strstr
_strupr
sprintf
memcpy
free
strcat
memset
malloc
strncmp
strcpy
strlen
strncpy
atoi
strchr
_initterm
_adjust_fdiv

psapi

EnumProcessModules
GetModuleFileNameExA

ws2_32

gethostname
connect
inet_addr
htons
gethostbyname
socket
inet_ntoa
recv
WSAStartup
send
select
setsockopt
closesocket

urlmon

URLDownloadToFileA

netapi32

NetApiBufferFree
NetUserEnum
NetUserDel

Exports

Exports

ServiceMain
WZCSvcMain
_ServiceMain@8
_WZCSvcMain@8

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.share
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20d8715cd4d48a50971942011ec1ad34

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

psapi

ws2_32

urlmon

netapi32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 11KB

.share Size: 512B - Virtual size: 80B

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 11KB

.share
Size: 512B - Virtual size: 80B

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 2KB - Virtual size: 1KB