0c0dcd78ac74e6bf068c20c12e67942d

Sharing

Copy URL Twitter E-mail

General

Target

0c0dcd78ac74e6bf068c20c12e67942d
Size

247KB
MD5

0c0dcd78ac74e6bf068c20c12e67942d
SHA1

392d2f31b9d3882c59f448b479f2a5ff5dacf686
SHA256

5c1c75f6118c97b890d72278cf1cf988a3f19f5f69f10742355d4a5a4db1dc10
SHA512

659a606a75542e06159836a2028ed9cfc1a33a86aab24b1d9c819891be6cc33c692972690c4193c9ffab5939f29e498dcb5f4a4dd5b0b39bb079395c15f9e1ef
SSDEEP

6144:J2GppEGyz2m0muv+NrBmkmpjejS69pyoqhN0:Yg2Go2Ouv+NNmkmpatPyFN0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c0dcd78ac74e6bf068c20c12e67942d

Files

0c0dcd78ac74e6bf068c20c12e67942d
.exe windows:4 windows x86 arch:x86

c79253649e6c0d370fca0b3765971ffe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToFileTime
ResumeThread
CompareFileTime
SetErrorMode
DeleteFileW
SetEndOfFile
FlushFileBuffers
SetThreadPriority
lstrcatW
DeviceIoControl
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
RaiseException
LeaveCriticalSection
CreateMutexW
GetSystemTimeAsFileTime
GetQueuedCompletionStatus
lstrcpyW
GetProcessHeap
ReleaseMutex
FindCloseChangeNotification
UnhandledExceptionFilter
HeapAlloc
CreateIoCompletionPort
lstrcmpW
lstrlenW
EnterCriticalSection
GetModuleHandleW
GetDriveTypeW
GetPrivateProfileStringW
GetSystemDirectoryW
TlsAlloc
IsDebuggerPresent
SetPriorityClass
WaitForSingleObject
SetFilePointer
GetComputerNameW
GetFileTime
GetTimeFormatW
PulseEvent
lstrlenA
ReleaseSemaphore
OpenSemaphoreW
CreateFileMappingW
CreateProcessW
OpenMutexW
ResetEvent
DuplicateHandle
WriteFile
FormatMessageW
GetSystemInfo
FindFirstChangeNotificationW
lstrcpynW
GetWindowsDirectoryW
WideCharToMultiByte
LocalAlloc
CreateSemaphoreW
CreateEventW
CreateFileW
GetCurrentThreadId
CreateThread
lstrcmpA
SetLastError
OpenProcess
GetPriorityClass
TlsFree
ExpandEnvironmentStringsW
TlsSetValue
GetPrivateProfileIntW
TerminateThread
SetCurrentDirectoryW
FindNextChangeNotification
LoadLibraryExW
FindNextFileW
FreeLibrary
GetFileSize
GetDateFormatW
GetSystemTime
DeleteCriticalSection
SetUnhandledExceptionFilter
OpenFileMappingW
CloseHandle
HeapReAlloc
GetCurrentDirectoryW
OutputDebugStringW
OpenEventW
GetTempFileNameW
FindClose
GetTempPathW
TlsGetValue
SetProcessWorkingSetSize
LocalFree
FindFirstFileW
GetLocalTime
HeapFree
VirtualAlloc

user32

MsgWaitForMultipleObjects
MessageBoxW
wsprintfW
PeekMessageW
LoadStringW
DispatchMessageW
FindWindowW

psapi

EnumProcessModules
GetModuleFileNameExW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
EnumDependentServicesW
CreateProcessAsUserW
RegOpenKeyA
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
GetTokenInformation
StartServiceW
SetSecurityDescriptorDacl
RegQueryValueExW
OpenSCManagerW
QueryServiceStatus
InitializeSecurityDescriptor
RegOpenKeyW
RegCloseKey
ControlService
RegDeleteValueW
OpenServiceW
CloseServiceHandle

activeds

AllocADsMem
BinarySDToSecurityDescriptor
ConvertSecDescriptorToVariant
ADsFreeEnumerator

itss

DllMain
DllGetClassObject

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hD
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kwF
Size: 512B - Virtual size: 333B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.RIy
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.BxMBD
Size: 512B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 213KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c79253649e6c0d370fca0b3765971ffe

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

psapi

advapi32

activeds

itss

Sections

.text Size: 16KB - Virtual size: 15KB

.hD Size: 1KB - Virtual size: 1KB

.kwF Size: 512B - Virtual size: 333B

.rdata Size: 4KB - Virtual size: 3KB

.RIy Size: 1KB - Virtual size: 2KB

.BxMBD Size: 512B - Virtual size: 554B

.data Size: 213KB - Virtual size: 457KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 15KB

.hD
Size: 1KB - Virtual size: 1KB

.kwF
Size: 512B - Virtual size: 333B

.rdata
Size: 4KB - Virtual size: 3KB

.RIy
Size: 1KB - Virtual size: 2KB

.BxMBD
Size: 512B - Virtual size: 554B

.data
Size: 213KB - Virtual size: 457KB

.rsrc
Size: 9KB - Virtual size: 9KB