197f12009eb1525cbad9e10dbac39697

General

Target

197f12009eb1525cbad9e10dbac39697
Size

28KB
MD5

197f12009eb1525cbad9e10dbac39697
SHA1

8d98f4a5b1b79db7373283ec59883f6f148694bb
SHA256

34d1d5882106a0a193e42c33afc8c0bccfd8393bc2b21a876c98efb95a434b50
SHA512

8234e9f491d1c5d5cda448fff0696a50b2b13bfb18fcf0758a6056ba50a53997fee20594dd846afe80027fbdc93d8fad9306e6b665f28409d2b47eb7e1f3f777
SSDEEP

384:5iXJIXnX+oGj4Lr2+oSqS79KwDxiqhHoNdA/:5iXe3X/GjLhSqS79KwfhHozA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
197f12009eb1525cbad9e10dbac39697

Files

197f12009eb1525cbad9e10dbac39697
.dll windows:4 windows x86 arch:x86

a4c6ef8a4efc40136a5f9818429d853c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAllocEx
OpenProcess
GetProcAddress
LoadLibraryA
VirtualFree
VirtualQueryEx
GetSystemInfo
VirtualAlloc
ReadProcessMemory
CreateThread
Sleep
WriteProcessMemory
Process32First
CreateToolhelp32Snapshot
CloseHandle
GetModuleHandleA
GetCurrentProcess
CreateRemoteThread
GetLastError
SetLastError
VirtualQuery
VirtualProtect
OutputDebugStringA
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
Process32Next
EnterCriticalSection

user32

wsprintfA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

ws2_32

getpeername
ntohs
getsockname
inet_ntoa
WSASetLastError
WSAStartup
inet_addr
gethostbyname
closesocket
send
socket
WSAGetLastError
htons
connect
WSASend

wininet

InternetOpenUrlA
InternetOpenA

msvcrt

_strcmpi
malloc
free
__CxxFrameHandler
_strupr
_adjust_fdiv
_initterm
_onexit
__dllonexit
_splitpath
_mbsnbcpy
atoi
_mbschr
??2@YAPAXI@Z
strchr
strstr
strncpy
sprintf
??3@YAXPAX@Z

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 886B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4c6ef8a4efc40136a5f9818429d853c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

wininet

msvcrt

Sections

.text Size: 12KB - Virtual size: 8KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 886B

.text
Size: 12KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 886B