11c0b856afd11f3a8e06e12f1bf777c5

Sharing

Copy URL Twitter E-mail

General

Target

11c0b856afd11f3a8e06e12f1bf777c5
Size

272KB
MD5

11c0b856afd11f3a8e06e12f1bf777c5
SHA1

4f761cf3bd67f650cdf35957efa247e271838aa5
SHA256

00e39c41c1b432178c7995da8b600df9855435a28db1303355346413e43ace38
SHA512

b27a1d60d7cff467813889dafe91bfdf5498277c2aede80dac1e44e69e00033f990275016877fc4a0f2c0e5019278467608a9b7a5dcf840af5eeb98b5e04d4e5
SSDEEP

3072:1BuJYWKGQqtlzpckBGr4cJxyeaPQhzJdoShA46QXMmAI11c9ZOoD79DKdVqSqHJd:uJdJlRGZJxyeayxC4HMKfOSOZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11c0b856afd11f3a8e06e12f1bf777c5

Files

11c0b856afd11f3a8e06e12f1bf777c5
.dll regsvr32 windows:4 windows x86 arch:x86

93ba1cef4fb1d3effe2325c687973eb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WinExec
DisableThreadLibraryCalls
lstrcmpiA
lstrcpyA
lstrlenA
GetModuleFileNameA
GetSystemTime
WriteFile
SetFilePointer
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetSystemDirectoryA
DeleteFileA
CopyFileA
TerminateThread
GetLastError
Process32Next
Process32First
CreateToolhelp32Snapshot
MultiByteToWideChar
GetShortPathNameA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
InitializeCriticalSection
LeaveCriticalSection
Sleep
HeapDestroy
DeleteCriticalSection
GetProcAddress
LoadLibraryA
lstrcatA
InterlockedIncrement
InterlockedDecrement
LockResource
GetWindowsDirectoryA
FindClose
FindFirstFileA
CompareStringW
CompareStringA
SetEndOfFile
SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetTempPathA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleHandleA
CreateThread
lstrlenW
EnterCriticalSection
WideCharToMultiByte
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
SetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
FlushFileBuffers
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
GetCurrentProcess
TerminateProcess
ExitProcess
RaiseException
GetVersion
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
RtlUnwind
GetLocalTime
GetTimeZoneInformation
InterlockedExchange

user32

DefWindowProcA
CharNextA
PostQuitMessage
LoadIconA
RegisterClassExA
GetSystemMetrics
CreateWindowExA
ShowWindow
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow

advapi32

RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

VariantCopy
SysFreeString
VarUI4FromStr
SysAllocString
VariantChangeType
VariantClear
LoadRegTypeLi
SysStringLen
LoadTypeLi
RegisterTypeLi

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

InternetReadFile
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
InternetGetConnectedState
InternetOpenUrlA

winmm

timeGetTime

netapi32

Netbios

shlwapi

PathFileExistsA

ws2_32

WSAStartup
WSACleanup
htons
connect
recv
ntohl
closesocket
socket

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93ba1cef4fb1d3effe2325c687973eb4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

version

wininet

winmm

netapi32

shlwapi

ws2_32

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 85KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 16KB

.rsrc Size: 144KB - Virtual size: 143KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 88KB - Virtual size: 85KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 144KB - Virtual size: 143KB

.reloc
Size: 12KB - Virtual size: 8KB