13fdca34241138e6a77925279e4302ed

Sharing

Copy URL Twitter E-mail

General

Target

13fdca34241138e6a77925279e4302ed
Size

13KB
MD5

13fdca34241138e6a77925279e4302ed
SHA1

e6b1cdc9ee7298db57e2351bdf08e3af9b00b821
SHA256

2c500ba321f9c8a50f16fcfb630797cfacc9b1efd1dc6bb3c038539ea1f4e118
SHA512

dcff212fbb9d63020d7f0a6d95ad86313c6d7319fe1ed1150cf5410d7cc5a1870ee5555bb17f0c21e4418e39854ff6e4932531c564efd1fa092751d0845325b3
SSDEEP

192:JM+mrX3/4CYUYIy5uV8U593zvX0jIbGtQ+bkgKTZvj+n25:izrXP4oWBU59DvX0jIat/IgGZvqn25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13fdca34241138e6a77925279e4302ed

Files

13fdca34241138e6a77925279e4302ed
.dll windows:4 windows x86 arch:x86

b32d13594e12af163b40bafcc9dd299e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
Process32Next
Sleep
Process32First
lstrcatA
lstrcpyA
lstrlenA
WriteProcessMemory
VirtualProtectEx
GetCurrentProcessId
TerminateProcess
LoadLibraryA
GetSystemDirectoryA
ExitProcess
GetProcAddress
CreateMutexA
TlsFree
TlsAlloc
DisableThreadLibraryCalls
VirtualFree
ReadFile
VirtualAlloc
GetFileSize
CreateFileA
FreeLibrary
GlobalFree
LoadLibraryExA
GlobalAlloc
WriteFile
CreateRemoteThread
WaitForSingleObject
CreateToolhelp32Snapshot
Module32First
lstrcmpiA
Module32Next
GetCurrentProcess
GetLastError
CreateThread
CloseHandle

user32

TranslateMessage
DispatchMessageA
GetMessageA
wsprintfA
MessageBoxA

advapi32

RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegOpenKeyExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
OpenProcessToken

shell32

ShellExecuteA

msvcrt

_except_handler3
_adjust_fdiv
malloc
_initterm
free
_strcmpi

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumPageFilesA
EnumPageFilesW
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetPerformanceInfo
GetProcessImageFileNameA
GetProcessImageFileNameW
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
MyEntryPoint
QueryWorkingSet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b32d13594e12af163b40bafcc9dd299e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 608B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 608B