0d797b52e9f9f6b0906f9d5be73b2dba

Sharing

Copy URL Twitter E-mail

General

Target

0d797b52e9f9f6b0906f9d5be73b2dba
Size

112KB
MD5

0d797b52e9f9f6b0906f9d5be73b2dba
SHA1

7b300d4f0d6737ece6f07735c5fc7604ca9e25de
SHA256

b9dbd5fe09c00fe468ac92af12c6ded295464ad6a2ae397e8f05684a2b7339db
SHA512

09354aa9ab72ae57ef8a1d0db4d3cc2631f02528cfe67adb8a04c768186584640332cbf35f1032d99d4dd6ae8ee90ebf1b5d29c50f93d999e185ac44fb5944fc
SSDEEP

1536:+mXBQpJSk5mMsT+n7C7CAWG3ZmaEPgBHG0Nh/0axooqaJG4m8:LXOpL5mM5W7CADmolD6VoqaJu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d797b52e9f9f6b0906f9d5be73b2dba

Files

0d797b52e9f9f6b0906f9d5be73b2dba
.dll windows:4 windows x86 arch:x86

26bad687ec31683cc632a85c1aab6ca9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FlushFileBuffers
RtlUnwind
GetCommandLineA
RaiseException
HeapAlloc
HeapFree
HeapSize
HeapReAlloc
ExitProcess
TerminateProcess
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
SetStdHandle
WriteFile
GetCurrentProcess
GetOEMCP
GetCPInfo
GlobalFlags
lstrcmpA
GetProcessVersion
LoadLibraryA
FreeLibrary
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetProcAddress
GetLastError
SetLastError
GetVersion
lstrcpynA
GetModuleFileNameA
lstrcpyA
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalAlloc
GlobalReAlloc
GlobalLock
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetCurrentThreadId
CloseHandle
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetFileAttributesA
Sleep
GetACP
GetSystemDirectoryA

advapi32

RegDeleteKeyA

comctl32

ord17

urlmon

URLDownloadToFileA

user32

CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
IsWindowEnabled
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
EnableWindow
GetTopWindow
MessageBoxA
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
DispatchMessageA
SendMessageA
GetKeyState
CallNextHookEx
SetWindowsHookExA
PeekMessageA

gdi32

SaveDC
RestoreDC
SelectObject
GetStockObject
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetTextColor
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetClipBox
DeleteObject
GetDeviceCaps
GetObjectA
CreateBitmap
SetBkColor

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

Exports

Exports

CComputerStart
ExplorerStart
downShutComputer

Sections

.text
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26bad687ec31683cc632a85c1aab6ca9

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

urlmon

user32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 61KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 16KB - Virtual size: 27KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 64KB - Virtual size: 61KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 16KB - Virtual size: 27KB

.reloc
Size: 12KB - Virtual size: 10KB