0be86d316fbb7e83ffa9b002dc93d790

Sharing

Copy URL Twitter E-mail

General

Target

0be86d316fbb7e83ffa9b002dc93d790
Size

363KB
MD5

0be86d316fbb7e83ffa9b002dc93d790
SHA1

3f02daae26717d447cf113b133a91ff0bf71d6fc
SHA256

fff0c88375db89beb37278fc8c580be6d526733fed222e05ffe2632a088c7bdd
SHA512

b22597e73d77452e9fe1d7ff8c47dfa8667ec0a92398da289cf30606d9752ee9ebde50167a525ae0efd0e985d5f36a85faa93d6a8db23a84f2bcf67a186d74b8
SSDEEP

6144:yX1qQyi2B85W2vRiXdIhs8mjMSzpDZZbQYOKrsdt8FpRo9UJX431e1hcAjAZ3kZl:21hJ2BYW2v4Xyhs8mISr6YOosdGrRo9S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0be86d316fbb7e83ffa9b002dc93d790

Files

0be86d316fbb7e83ffa9b002dc93d790
.dll windows:6 windows x86 arch:x86

9ddf968da1d6b2349bc21e446782d57a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
FlushInstructionCache
IsWow64Process
HeapFree
HeapValidate
HeapSize
HeapAlloc
GetProcessHeap
lstrcmpiA
HeapReAlloc
VirtualQuery
GetLastError
ReadProcessMemory
GetFileSizeEx
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
OpenProcess
LoadLibraryA
GetProcAddress
WideCharToMultiByte
CreateNamedPipeA
SetLastError
FileTimeToSystemTime
CreateToolhelp32Snapshot
GlobalAlloc
GlobalFree
WTSGetActiveConsoleSessionId
GetNativeSystemInfo
CreateProcessA
GetExitCodeThread
CreateThread
InterlockedIncrement
GetVersionExA
DecodePointer
SetFilePointerEx
GetConsoleMode
VirtualProtectEx
GetModuleHandleA
SetFilePointer
VirtualAlloc
WriteFile
GetCurrentProcess
VirtualFree
WriteProcessMemory
ReadFile
DeleteCriticalSection
Sleep
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateFileA
FindNextFileA
FreeLibrary
GetConsoleCP
FlushFileBuffers
SetStdHandle
CreateFileW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
FindClose
LCMapStringW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
TerminateProcess
RaiseException
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
GetStdHandle
GetFileType
WriteConsoleW
GetACP

user32

wsprintfA

advapi32

RevertToSelf
CreateProcessAsUserA
DuplicateTokenEx
RegDisablePredefinedCacheEx
GetUserNameA
ImpersonateLoggedOnUser
DuplicateToken
ConvertSidToStringSidW
GetTokenInformation
CryptDestroyKey
CryptGenRandom
CryptDestroyHash
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenProcessToken
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

userenv

CreateEnvironmentBlock

shlwapi

StrStrIA
StrCmpNIA
StrCmpNA
wnsprintfA

wtsapi32

WTSQueryUserToken

ws2_32

setsockopt
connect
htons
gethostbyname
WSAGetLastError
socket
shutdown
closesocket
bind
accept
recv
send
WSAStartup
htonl

Exports

Exports

?AFind@@YAHPAX@Z
?AIAnAiAt@@YAXH@Z
?MegaFreeBuffer@@YAXPAX@Z
?ReleaseModuleBuffers@@YAXPAX@Z
?ShAuAtadAoAwan@@YAXXZ
?ShutdownPrimary@@YAXXZ
?SuperControl@@YAHPAX@Z
?SuperControlTimer@@YAHPAX@Z
Control
FreeBuffer
ProcessStart
Release
Start
StartSubProcess

Sections

.text
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ddf968da1d6b2349bc21e446782d57a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

userenv

shlwapi

wtsapi32

ws2_32

Exports

Exports

Sections

.text Size: 311KB - Virtual size: 311KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 311KB - Virtual size: 311KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 9KB - Virtual size: 8KB