2845106d15e5205df49d4457289d6943

Sharing

Copy URL Twitter E-mail

General

Target

2845106d15e5205df49d4457289d6943
Size

160KB
MD5

2845106d15e5205df49d4457289d6943
SHA1

291919574f654e00bf5ded6cc82b35fcf2c23b26
SHA256

0c6f60371d30eb6fc9b5c6f791f56619c8e1130e01da93501533b87da7d7138a
SHA512

8d71b6f2444e2317c158823e24d8a72a09d81152fc255bee486e6ea37fd5660eb93e592b0cfa1530e7c7b570e1b2592346ae4adeb41c85d994f02c61dc9fffd8
SSDEEP

3072:s3MgP9p4xtn7ulT2ltwo/JOA3kXrAhbQWZSjpkS:sJPzk7/lth/p0XrsQ2a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2845106d15e5205df49d4457289d6943

Files

2845106d15e5205df49d4457289d6943
.dll windows:4 windows x86 arch:x86

5af9c1a0799f95377d984dffe6164382

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

xmltok

XmlPrologStateInitExternalEntity
XmlGetUtf16InternalEncodingNS
XmlPrologStateInit
XmlGetUtf16InternalEncoding
XmlUtf16Encode
XmlParseXmlDeclNS
XmlParseXmlDecl
XmlInitEncodingNS
XmlInitEncoding
XmlSizeOfUnknownEncoding
XmlInitUnknownEncodingNS
XmlInitUnknownEncoding

kernel32

GetModuleFileNameA
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetLastError
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
DisableThreadLibraryCalls
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
QueryPerformanceCounter

Exports

Exports

XML_DefaultCurrent
XML_ErrorString
XML_ExternalEntityParserCreate
XML_GetBase
XML_GetBuffer
XML_GetCurrentByteCount
XML_GetCurrentByteIndex
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_GetErrorCode
XML_GetIdAttributeIndex
XML_GetSpecifiedAttributeCount
XML_Parse
XML_ParseBuffer
XML_ParserCreate
XML_ParserCreateNS
XML_ParserFree
XML_SetBase
XML_SetCdataSectionHandler
XML_SetCharacterDataHandler
XML_SetCommentHandler
XML_SetDefaultHandler
XML_SetDefaultHandlerExpand
XML_SetDoctypeDeclHandler
XML_SetElementHandler
XML_SetEncoding
XML_SetExternalEntityRefHandler
XML_SetExternalEntityRefHandlerArg
XML_SetExternalParsedEntityDeclHandler
XML_SetInternalParsedEntityDeclHandler
XML_SetNamespaceDeclHandler
XML_SetNotStandaloneHandler
XML_SetNotationDeclHandler
XML_SetParamEntityParsing
XML_SetProcessingInstructionHandler
XML_SetUnknownEncodingHandler
XML_SetUnparsedEntityDeclHandler
XML_SetUserData
XML_UseParserAsHandlerArg

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5af9c1a0799f95377d984dffe6164382

Headers

File Characteristics

Imports

xmltok

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 4KB - Virtual size: 1KB