095fa87aa16b0d58bb7ad8caf4aa782f

Sharing

Copy URL Twitter E-mail

General

Target

095fa87aa16b0d58bb7ad8caf4aa782f
Size

120KB
MD5

095fa87aa16b0d58bb7ad8caf4aa782f
SHA1

2550d73c56eb8109e9b10ba7b1d20008e708cbaa
SHA256

bdc6173ce961944331de30b2b8a4937f6459a68567ffaeadbd58a4b984ab2550
SHA512

8ea4e112eaefcae82b183c3676192fb8aa56139c2249e930f202b00e87d4712ba2902250e3c0101bbbc587dfcdd22cdb2c968255e365d0252c33559699d63b2c
SSDEEP

1536:f1mHkSfm5eMGdgbTF+dobwna6LQRc76ifVTes4CDusjiI5b:fwESuGBdIsF0RM60VTes4CDusji6b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
095fa87aa16b0d58bb7ad8caf4aa782f

Files

095fa87aa16b0d58bb7ad8caf4aa782f
.dll windows:4 windows x86 arch:x86

dae7db6062a8f09bc9d142d35e37e908

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
CreateIoCompletionPort
ResetEvent
Sleep
WaitForSingleObject
WinExec
lstrcpyA
TerminateThread
lstrcatA
GetLocalTime
lstrcmpA
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetVersionExA
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
FreeLibrary
GetProcAddress
LoadLibraryA
OpenProcess
GetExitCodeThread
GetTickCount
SetErrorMode
FreeConsole
LocalSize
GetLastError
SetStdHandle
FindClose
LCMapStringW
GetQueuedCompletionStatus
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
SetEvent
CreateEventA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
CloseHandle
RemoveDirectoryA
InitializeCriticalSection
GetLogicalDriveStringsA
GetVolumeInformationA
lstrlenA
GetDiskFreeSpaceExA
GetDriveTypeA
DeleteFileA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
GetEnvironmentStrings
FreeEnvironmentStringsW
LocalAlloc
FindFirstFileA
FreeEnvironmentStringsA
GetModuleFileNameA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
HeapCreate
HeapDestroy
HeapSize
ExitProcess
TlsGetValue
SetLastError
TlsFree
LocalReAlloc
FindNextFileA
LCMapStringA
LocalFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetModuleHandleA
RaiseException
HeapFree
GetVersion
DeleteCriticalSection
FlushFileBuffers
GetCommandLineA
WideCharToMultiByte
InterlockedIncrement
RtlUnwind
HeapAlloc
HeapReAlloc
InterlockedDecrement

user32

GetWindowTextA
GetActiveWindow
GetKeyNameTextA
GetFocus
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
ReleaseDC
GetDC
wsprintfA
CloseDesktop
GetDesktopWindow
SetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
CloseWindow
IsWindow
SendMessageA
CreateWindowExA
GetSystemMetrics
ExitWindowsEx
EnumWindows
IsWindowVisible
GetWindowThreadProcessId

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
CreateDCA
GetDIBits
SelectObject
CreateDIBSection
BitBlt
DeleteDC
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExA
SetServiceStatus
RegisterServiceCtrlHandlerExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegQueryValueExA
RegQueryValueA

shell32

SHGetFileInfoA

dbghelp

MakeSureDirectoryPathExists

ws2_32

connect
htons
gethostbyname
socket
WSAGetLastError
inet_ntoa
closesocket
getpeername
getsockname
gethostname
WSARecv
WSAStartup
send
ntohs

imm32

ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext

wininet

InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA

urlmon

URLDownloadToFileA

avicap32

capCreateCaptureWindowA

psapi

EnumProcessModules
GetModuleFileNameExA

Exports

Exports

ServiceMain

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae7db6062a8f09bc9d142d35e37e908

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

dbghelp

ws2_32

imm32

wininet

urlmon

avicap32

psapi

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 76KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 16KB

.shared Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 80KB - Virtual size: 76KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 16KB

.shared
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB