2190db2c50c6cebffdb13ddeeec23186

Sharing

Copy URL Twitter E-mail

General

Target

2190db2c50c6cebffdb13ddeeec23186
Size

29KB
MD5

2190db2c50c6cebffdb13ddeeec23186
SHA1

cc9466b57bc1992bc1ed31eb963df3662e287886
SHA256

bf97be25c653d648dd27ef76b9fc4b82484940e257c7eaf94f76bfe7561fe137
SHA512

6293dea206dd9d7d6adc14742420e2d1d16e0c11dd25768ce45e77c4c0b07f96d9b77151c81057ca510536b16357892d638c0f787886a31f35bc9f12d15823a6
SSDEEP

384:BrREU6u70WkkWDHcF5DLtlixHxbs/uooYVODQydLP59xOsHDBaB:BrREU6u7glcF5Fl2s/fTADQov1a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2190db2c50c6cebffdb13ddeeec23186

Files

2190db2c50c6cebffdb13ddeeec23186
.dll windows:4 windows x86 arch:x86

d73fd7d3151429b1c8bbbc52396e4dc5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
GetTempPathA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateThread
GetCommandLineA
DeleteFileA
GetModuleHandleA
SetFileAttributesA
SizeofResource
LockResource
LoadResource
FindResourceA
CopyFileA
GetModuleFileNameA
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTickCount
lstrcmpiA
lstrcpynA
lstrlenA
lstrcpyA
lstrcmpA
Sleep
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
IsBadReadPtr
OutputDebugStringA

user32

PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
EnumWindows
GetSystemMetrics
ReleaseDC
GetDC
IsRectEmpty
GetWindowThreadProcessId
FindWindowExA
FindWindowA
PrintWindow
GetWindowInfo
SetForegroundWindow
ShowWindow
GetActiveWindow
IsIconic
IsWindowVisible
GetWindowTextA
CallNextHookEx

gdi32

GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

wininet

InternetReadFile
HttpSendRequestA
InternetQueryDataAvailable
InternetConnectA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetOpenA
InternetCloseHandle
HttpOpenRequestA

msvcrt

??2@YAPAXI@Z
free
malloc
atoi
wcscmp
strstr
memmove
strrchr
sprintf
strchr
_beginthread

gdiplus

GdiplusShutdown
GdipSaveImageToFile
GdipLoadImageFromFile
GdipAlloc
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCloneImage
GdipGetImageEncoders
GdiplusStartup

Exports

Exports

DeleteSelf
wdof
wdon

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d73fd7d3151429b1c8bbbc52396e4dc5

Headers

File Characteristics

Imports

kernel32

user32

gdi32

wininet

msvcrt

gdiplus

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 2KB