19bdb29c1ae9066988e6a66ae4d86d5f

Sharing

Copy URL Twitter E-mail

General

Target

19bdb29c1ae9066988e6a66ae4d86d5f
Size

72KB
MD5

19bdb29c1ae9066988e6a66ae4d86d5f
SHA1

a87fba2f2df6e856777a3703ee3495135efccf44
SHA256

5007c6821957425af0c5805d49c6aec9ec9e75cfaf93cf4fab6ccf2bfc7fb7c0
SHA512

2dec0bcaf27322f0b7561fa28d70e4d317351d88193f59fe9e25418cf1634a93864d9bbd9ac84d0a665fbea095700c689f1ecf303bfaa81332449e239a61a0b7
SSDEEP

1536:bf/tmm1QUyiG3rTeOX89BPo8gyrBzsoioopq:rom1QUyZoBPjBooioopq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19bdb29c1ae9066988e6a66ae4d86d5f

Files

19bdb29c1ae9066988e6a66ae4d86d5f
.dll windows:4 windows x86 arch:x86

6d3489c714bab81a35a8b7dab8179600

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
WriteFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
CreateEventA
SetEvent
FreeConsole
SetUnhandledExceptionFilter
GetWindowsDirectoryA
GetCurrentProcessId
CreateFileA
SetFilePointer
ReadFile
GetSystemDirectoryA
GetTickCount
GetModuleHandleA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
OpenProcess
lstrlenA
Sleep
DeleteFileA
SetLastError
GetLastError
WaitForSingleObject
CloseHandle
lstrcatA
GetProcessHeap
HeapAlloc
SetEndOfFile
HeapFree
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetCPInfo
IsBadCodePtr
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TlsAlloc
TlsFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr

user32

wsprintfA
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
SetThreadDesktop

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey

wininet

InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
DeleteUrlCacheEntry

urlmon

URLDownloadToFileA

Exports

Exports

ServiceMain

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d3489c714bab81a35a8b7dab8179600

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

urlmon

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 25KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 25KB

.reloc
Size: 8KB - Virtual size: 4KB