2742c93ab30fe71baf793110e3f3dcfe

Sharing

Copy URL Twitter E-mail

General

Target

2742c93ab30fe71baf793110e3f3dcfe
Size

124KB
MD5

2742c93ab30fe71baf793110e3f3dcfe
SHA1

dea75c3a804a66959068c6e8ca7f04c27f85794f
SHA256

48ae922fb650a36add8f7eea9369e04bb85567f6c96c89e29fc84e0fe917f89c
SHA512

b3b3a4c2bdc2d1050394f5a434cb15baaf44d544b7ea77ff411f6e76f6e8595681f11e90a84e158eb40ad8bf80fe3d714281c09322d6bda1d1487948dbd25f33
SSDEEP

1536:3UFzrhkQgZ6RuealixsoVY2tzXOBv5UXHfHhvZ44LyYh10lyCMwMeYIFAe2++Uvl:SzSQgZ6upGY2tqGfb10pMTeR+UvlH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2742c93ab30fe71baf793110e3f3dcfe

Files

2742c93ab30fe71baf793110e3f3dcfe
.dll windows:4 windows x86 arch:x86

c8d881ec5d58933faaf62a8c7745233b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadWritePtr
MoveFileExA
GetExitCodeThread
CreateThread
GetCurrentThreadId
SystemTimeToFileTime
GetSystemTime
GetModuleFileNameA
DeleteFileA
CreateFileA
GetWindowsDirectoryA
OpenProcess
GetCurrentProcessId
GetProcessTimes
GetLocaleInfoA
EnterCriticalSection
GetVersionExA
GetCurrentProcess
HeapReAlloc
GetOverlappedResult
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
Sleep
CloseHandle
GetLastError
FreeLibrary
ResetEvent
SetEvent
CreateEventA
IsBadReadPtr
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
HeapFree
GetProcessHeap
HeapAlloc
CreateMutexA
QueryDosDeviceA
DefineDosDeviceA
DeviceIoControl
GetVolumeInformationA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetCommandLineA
QueryPerformanceCounter
GetTickCount
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
TerminateProcess
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile

user32

wsprintfA

advapi32

GetLengthSid
RegEnumKeyExA
RegDeleteValueA
InitializeSecurityDescriptor
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AllocateAndInitializeSid
AddAce
IsValidSecurityDescriptor
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

dnsapi

DnsRecordListFree
DnsQuery_A

ws2_32

htons
closesocket
gethostname
WSAStartup
WSASend
WSARecv
WSACreateEvent
WSAEventSelect
WSASocketA
WSAConnect
WSAEnumNetworkEvents
WSACloseEvent
WSAGetOverlappedResult
WSAGetLastError
shutdown
setsockopt

iphlpapi

GetIpAddrTable

psapi

GetProcessMemoryInfo

Exports

Exports

mlmain

Sections

.text
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8d881ec5d58933faaf62a8c7745233b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

dnsapi

ws2_32

iphlpapi

psapi

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 89KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 92KB - Virtual size: 89KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 7KB