3b413d97060e24d280dd0f4872b9b903

Sharing

Copy URL

Twitter E-mail

General

Target

3b413d97060e24d280dd0f4872b9b903
Size

277KB
MD5

3b413d97060e24d280dd0f4872b9b903
SHA1

1cb71d9732b88e5644fde414e1317c93af9b4c7b
SHA256

c38809cff06deb27896a1f30469c12c648e1ccbfb3058841cb619ccfff1fdbcb
SHA512

587d99ef299d9292599eb205cc31e071669dabe6edfd240857cce13d0e5e101de0e5fadb15830cecae4fce240c80e12577a994c9a5971dd65013ab4fb250d862
SSDEEP

6144:pyl/zy8Orezu7I/mfzJGpgJina9Lcp9UBvkUPVOtjV/EAZ9Qt0ebGZqABySwAp8k:pO/zy88ezu6mfzJGpgJrTkUPViebSqVg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b413d97060e24d280dd0f4872b9b903

Files

3b413d97060e24d280dd0f4872b9b903
.dll windows:5 windows x86 arch:x86

0699692f9b26eb8273029039297d358b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
InterlockedCompareExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
IsDebuggerPresent
MulDiv

user32

CharNextA
GetSystemMetrics
GetDC
ReleaseDC
SetCursor
GetCursor
LoadCursorA
DrawTextA

gdi32

DeleteDC
GetDeviceCaps
CreateDIBSection
SetGraphicsMode
GetBkMode
SetBkColor
SetBkMode
CreateFontA
GetObjectA
DeleteObject
SelectObject
SetTextColor
GetTextExtentPoint32A
TextOutA
CreateCompatibleDC

msvcr90

_strnicmp
strrchr
strncpy
??_V@YAXPAX@Z
memset
strstr
strchr
atoi
strncmp
??_U@YAPAXI@Z
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
_vsnprintf
_stricmp
tolower
memmove
strtoul
isdigit
atol
isspace
isxdigit
toupper
isalpha
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_except_handler4_common
sprintf

Exports

Exports

CanUnload
RMACreateInstance

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0699692f9b26eb8273029039297d358b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

msvcr90

Exports

Exports

Sections

.text Size: 86KB - Virtual size: 85KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 169KB - Virtual size: 169KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 169KB - Virtual size: 169KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB