09a2dc943270114579f18412cdbea0bf

Sharing

Copy URL Twitter E-mail

General

Target

09a2dc943270114579f18412cdbea0bf
Size

45KB
MD5

09a2dc943270114579f18412cdbea0bf
SHA1

f54f88a077a7c77d27bceceaebec428d6e2dfe81
SHA256

326cd6790a4d1ea180244c0d6d69b983aaaff4f8496b10e14cbe700083d114b3
SHA512

b6ce4b30c448709ef54102d7aac13926c9beffbf8d3e5cad4ae86bd421eee8412ffaa35d71aac57643a7de6fe6a4fd3796b9254353b52f14a2d6cbb875ce4724
SSDEEP

768:M2P0008KCTzXaYCgmPMrAQ/USEtaZR9k/Ii2eoN8borv9Ys7Sv2Bn:zP9KC3nCgOMrAQcSiaKIixcvesc2B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09a2dc943270114579f18412cdbea0bf

Files

09a2dc943270114579f18412cdbea0bf
.dll windows:4 windows x86 arch:x86

fc2708ef47a37f6345a3c07b1b9f7bdc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ShowWindow
wsprintfA
DefWindowProcA
PostQuitMessage
DispatchMessageA
RegisterClassExA
CreateWindowExA
MoveWindow
SendMessageA
RegisterDeviceNotificationA
GetMessageA
TranslateMessage

advapi32

OpenProcessToken
QueryServiceStatus
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegQueryValueExA

ws2_32

htonl
gethostbyname
gethostname
inet_ntoa

mpr

WNetCloseEnum
WNetOpenEnumA
WNetCancelConnection2A
WNetAddConnection2A
WNetEnumResourceA

msvcrt

free
time
srand
tolower
_strlwr
_stricmp
strcpy
rand
fputs
strstr
_initterm
fgets
fclose
memset
memcmp
strlen
strcat
sprintf
memcpy
_except_handler3
strcmp
strncpy
malloc
_adjust_fdiv
fopen

kernel32

GetDriveTypeA
GetLogicalDrives
FindNextChangeNotification
WaitForMultipleObjects
DeviceIoControl
OpenEventA
CreateThread
ReadProcessMemory
CopyFileA
FindFirstChangeNotificationA
ExitThread
DisableThreadLibraryCalls
FreeLibrary
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
Sleep
WaitForSingleObject
GlobalAlloc
OpenMutexA
OpenProcess
OpenThread
QueueUserAPC
Thread32First
Thread32Next
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemDirectoryA
GetModuleHandleA
lstrlenA
MultiByteToWideChar
SetFileAttributesA
GetFileTime
CreateFileMappingA
MapViewOfFile
GetFileSize
SetFilePointer
SetFileTime
UnmapViewOfFile
RemoveDirectoryA
GetTempFileNameA
MoveFileA
TerminateProcess
GetThreadContext
VirtualAllocEx
WriteProcessMemory
SetThreadContext
ResumeThread
CreateMutexA
GetLastError
WideCharToMultiByte
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetCurrentProcess
WriteFile
DeleteFileA
CloseHandle
CreateFileA
GetTempPathA
ReadFile
GetCurrentProcessId
CreateProcessA
GetVolumeInformationA
GetVersionExA
GetFileAttributesA
lstrcpynA
lstrcatA
GetWindowsDirectoryA
ExitProcess
VirtualFree
VirtualAlloc

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc2708ef47a37f6345a3c07b1b9f7bdc

Headers

File Characteristics

Imports

user32

advapi32

ws2_32

mpr

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 2KB - Virtual size: 2KB