11a99c702c5b35d51f3ace76bfa933d8

Sharing

Copy URL Twitter E-mail

General

Target

11a99c702c5b35d51f3ace76bfa933d8
Size

88KB
MD5

11a99c702c5b35d51f3ace76bfa933d8
SHA1

f2f331e81225297fb1fb894240f3ebd7acd7a194
SHA256

86ed2021eea83c7aca8df32bd154d213c98f15e6f971d1633d36fb11d3097368
SHA512

70d82092a4a5d46fcc4b500c12a91b0ff15d2b3138e07fbbbafa4971e58c2160cc1662dcfb4a82a3da596abf75ee02b4f3beca5b439d325ccbf2b24f456dee01
SSDEEP

1536:XYTmkzyc862rKvE9BSqT3ZpxNWMWsdPFuNfmoHs:oTQc8JrKs9BSMV1PFWmoHs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11a99c702c5b35d51f3ace76bfa933d8

Files

11a99c702c5b35d51f3ace76bfa933d8
.dll windows:4 windows x86 arch:x86

38fd57fdfebc0b8f890c1547d6bb865c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
IsBadReadPtr
VirtualQuery
CloseHandle
GetSystemDirectoryA
CreateProcessA
WideCharToMultiByte
CreateProcessW
DeleteCriticalSection
GetLastError
GetCurrentProcess
VirtualAllocEx
CreateRemoteThread
InitializeCriticalSection
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
GetModuleHandleA
OpenProcess
VirtualProtectEx
WriteProcessMemory
FreeLibrary
LoadLibraryA
GetProcAddress
GetSystemInfo
OutputDebugStringA
DisableThreadLibraryCalls
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement
RaiseException
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcessId
HeapAlloc
HeapSize
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
Sleep
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
IsBadCodePtr
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
GetStringTypeA
GetStringTypeW
FlushFileBuffers
InterlockedExchange
ReadFile

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyW
RegEnumKeyA
RegEnumValueW
RegEnumValueA

imagehlp

ImageDirectoryEntryToData

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38fd57fdfebc0b8f890c1547d6bb865c

Headers

File Characteristics

Imports

kernel32

advapi32

imagehlp

Sections

.text Size: 62KB - Virtual size: 62KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 5KB - Virtual size: 15KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 62KB - Virtual size: 62KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 5KB - Virtual size: 15KB

.reloc
Size: 7KB - Virtual size: 6KB