0ca5aca3cd1ebc125ca345bcbd48d889

Sharing

Copy URL Twitter E-mail

General

Target

0ca5aca3cd1ebc125ca345bcbd48d889
Size

245KB
MD5

0ca5aca3cd1ebc125ca345bcbd48d889
SHA1

a59193ad02d2965d67e8e805ae0c06142cc08dc6
SHA256

bd039179b5b8613090007411d9d30d41311dbbc5871add25782d8c0755e58327
SHA512

a314ee3285ff8dc90fb463b1c6b9d6e73fc21652f627b8198b6d2881a79d8cc2a4f62af1eb1ff58a76d10a3a91a338c76bd7e998f5a485edf029249e58989f11
SSDEEP

6144:6hIbwCyBBYYgT+3dyTvmJcMtdkKdCJSyhKFw:YxbBaYgSNyTvi/keChI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ca5aca3cd1ebc125ca345bcbd48d889

Files

0ca5aca3cd1ebc125ca345bcbd48d889
.dll windows:4 windows x86 arch:x86

23234c852f9761ace6f49edce7044c2b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

avicap32

capGetDriverDescriptionA

winmm

mciSendStringA

user32

CreateWindowExA

advapi32

RegQueryValueExA

oleaut32

SafeArrayPtrOfIndex

comctl32

ImageList_SetIconSize

ole32

CoCreateInstance

gdi32

UnrealizeObject

shell32

ShellExecuteA

wininet

FindNextUrlCacheEntryA

netapi32

NetApiBufferFree

version

VerQueryValueA

wsock32

WSACleanup

Exports

Exports

ServiceMain

Sections

CODE
Size: 184KB - Virtual size: 492KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 77B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MaskPE
Size: 3KB - Virtual size: 24KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

23234c852f9761ace6f49edce7044c2b

Headers

File Characteristics

Imports

kernel32

avicap32

winmm

user32

advapi32

oleaut32

comctl32

ole32

gdi32

shell32

wininet

netapi32

version

wsock32

Exports

Exports

Sections

CODE Size: 184KB - Virtual size: 492KB

.edata Size: 512B - Virtual size: 77B

.reloc Size: 29KB - Virtual size: 28KB

.rsrc Size: 18KB - Virtual size: 21KB

.MaskPE Size: 3KB - Virtual size: 24KB

.rsrc Size: 7KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 512B

CODE
Size: 184KB - Virtual size: 492KB

.edata
Size: 512B - Virtual size: 77B

.reloc
Size: 29KB - Virtual size: 28KB

.rsrc
Size: 18KB - Virtual size: 21KB

.MaskPE
Size: 3KB - Virtual size: 24KB

.rsrc
Size: 7KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 512B