1b0e24e506668034e29dd8aea1c6677c

Sharing

Copy URL

Twitter E-mail

General

Target

1b0e24e506668034e29dd8aea1c6677c
Size

7.6MB
MD5

1b0e24e506668034e29dd8aea1c6677c
SHA1

7357fde1648240c4b3d3d9aab941879438efeafe
SHA256

65d1ae0e93298f89534196dee2400ee5f033f2b871218e1ab8b27ef8eb36c5d3
SHA512

7fd6f0981f4851c5ab35f95bb03f7b2cc5b8e8fc0d24ae270d68df2c03ad83dc94a89cc32ff3bfa7ac86c63155c2dbc109780a3a871f9789e679db39ecb46877
SSDEEP

196608:ydez+UGF216GpEifNUBUJ1hnYwMr+39RIFwacGKjv:y1k6mhuUHhTMrcJacGKT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b0e24e506668034e29dd8aea1c6677c

Files

1b0e24e506668034e29dd8aea1c6677c
.dll windows:4 windows x86 arch:x86

e56e03f797ffa15bb1327dded8cf42d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord5714
ord4622
ord3738
ord561
ord3953
ord1134
ord6467
ord2725
ord860
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord1775
ord5280
ord2124
ord4425
ord3597
ord641
ord1146
ord1168
ord324
ord2302
ord5289
ord4710
ord2379
ord755
ord470
ord2688
ord6215
ord2086
ord1132
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord1131
ord2512
ord2554
ord4486
ord6375
ord815
ord4274
ord540
ord800
ord4034
ord1949
ord818
ord2135
ord567
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord823
ord4234
ord825

msvcrt

_adjust_fdiv
malloc
memset
_strlwr
_strdup
free
strcmp
strlen
memcpy
atoi
_stricmp
strchr
__CxxFrameHandler
_strnicmp
_initterm
_onexit
__dllonexit
rand
_beginthreadex
memcmp
sprintf
strncmp
strcat
strcpy
strrchr
??1type_info@@UAE@XZ

kernel32

GetCurrentProcess
GetSystemInfo
DeleteCriticalSection
InitializeCriticalSection
SetFileAttributesA
GetLocalTime
GetTempPathA
CreateDirectoryA
GetTempFileNameA
MoveFileExA
CreateProcessA
GetTickCount
GetFileSize
ReadFile
GetModuleFileNameA
GetSystemDirectoryA
OutputDebugStringA
CreateFileA
GetQueuedCompletionStatus
ResetEvent
SetEvent
CreateEventA
WaitForSingleObject
CloseHandle
SetLastError
VirtualQuery
VirtualProtect
GetProcAddress
GetLastError
ReadProcessMemory
WriteProcessMemory
LoadLibraryA
GetModuleHandleA
LocalFree
LocalAlloc
LeaveCriticalSection
TerminateThread
CreateIoCompletionPort
EnterCriticalSection
WaitForMultipleObjects
PostQueuedCompletionStatus
Sleep
WriteFile
DeleteFileA
MoveFileA

user32

EnableWindow
GetSystemMetrics
IsIconic
PostMessageA
GetClientRect
SendMessageA
DrawIcon
SetTimer
KillTimer
LoadIconA

advapi32

RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA

ole32

OleUninitialize
OleInitialize

oleaut32

VariantInit

dbghelp

ImageDirectoryEntryToData

ws2_32

WSARecv
WSASend
WSAIoctl
WSAConnect
WSASocketA
WSAGetLastError
htons
closesocket
WSACleanup
WSAStartup
inet_addr

mswsock

GetAcceptExSockaddrs
AcceptEx

dnsapi

DnsRecordListFree
DnsQuery_A

Exports

Exports

AcquireDDThreadLock
AlphaBlend
CheckFullscreen
CompleteCreateSysmemSurface
D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
D3DParseUnknownCommand
DDGetAttachedSurfaceLcl
DDInternalLock
DDInternalUnlock
DSoundHelp
DebugSetLevel
DebugSetMute
Direct3DCreate8
Direct3DCreate9
Direct3DCreate9Ex
Direct3DShaderValidatorCreate9
DirectDrawCreate
DirectDrawCreateClipper
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DllCanUnloadNow
DllGetClassObject
DllInitialize
GetDDSurfaceLocal
GetOLEThunkData
GetSurfaceFromDC
GradientFill
PSGPError
PSGPSampleTexture
RegisterSpecialCase
ReleaseDDThreadLock
TestPopup
TransparentBlt
ValidatePixelShader
ValidateVertexShader
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification
vSetDdrawflag

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e56e03f797ffa15bb1327dded8cf42d8

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

dbghelp

ws2_32

mswsock

dnsapi

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 6KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 6KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB