28c33362fe768bae9264e58979194549

Sharing

Copy URL Twitter E-mail

General

Target

28c33362fe768bae9264e58979194549
Size

59KB
MD5

28c33362fe768bae9264e58979194549
SHA1

30972b126ba4b676f0c8fdcfd6131b8e275ca18b
SHA256

bf1ba01a8d65309a04fc45c4a630c9de4487a331445d77ad7f150e87d2fdf88b
SHA512

d3058d74912bb4135e02cb8448e19aecda17db01c74ab64a4ac6ac0580ee9a3b1846d2d972a1e0f231a77e08e7eb3bba4dd57db5fd728f974fb92548022fbc8e
SSDEEP

768:W8zYLAuu4bS+L9ftnTAbV8jGHFslXvpAfKKVlJHWTN6owGwb5YNfDiJ0I6Wx:WUg5FL5ROejq2XvpS5/GwmRrI6W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28c33362fe768bae9264e58979194549

Files

28c33362fe768bae9264e58979194549
.dll windows:5 windows x86 arch:x86

a9e0fadadc63f8b508ba54626ac27ca0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualQuery
RtlUnwind
GetTempPathA
UnmapViewOfFile
GetModuleFileNameW
ReleaseMutex
DeleteFileA
LocalAlloc
ResetEvent
OpenFileMappingA
CreateProcessA
TerminateProcess
SleepEx
SizeofResource
GetTempFileNameA
GlobalDeleteAtom
CloseHandle
CreateMutexA
CompareStringW
WaitForMultipleObjects
LeaveCriticalSection
GetComputerNameA
MapViewOfFileEx
lstrlenA
FormatMessageA
RaiseException
GetModuleHandleA
GetFileSize
CreateFileMappingA
lstrlenW
FindFirstFileA
GetUserDefaultLCID
TerminateThread
VirtualAlloc
VirtualFree
GetExitCodeProcess
SetEndOfFile
GlobalGetAtomNameA

gdi32

CloseEnhMetaFile
DeleteDC
Pie
SetMapMode
GetWindowOrgEx
LineTo
GetStockObject
SaveDC
CreateSolidBrush
GetTextMetricsA
GetObjectA
GetEnhMetaFileDescriptionA
TextOutA
Polyline
OffsetClipRgn
GetClipBox
FrameRgn
CopyEnhMetaFileA
GetNearestColor

user32

MapWindowPoints
GetWindowTextA
DefMDIChildProcA
DefFrameProcA
LoadIconA
GetWindowTextLengthW
RemoveMenu
FillRect
ScrollDC
CharUpperW
GetWindowPlacement
GetKeyboardLayout
SendDlgItemMessageA
InsertMenuA
GetCapture
PostThreadMessageA
UnregisterClassW
IsWindow
SetForegroundWindow
GetWindow
DispatchMessageA
LoadBitmapA
DrawEdge
ScrollWindow
ShowOwnedPopups
GetClassNameA
GetKeyboardLayoutList
GetTopWindow
GetSystemMenu
ChildWindowFromPointEx
GetCaretPos
RedrawWindow
FrameRect
DestroyMenu
GetLastActivePopup
InvalidateRect
SetMenu
SetScrollRange
CallNextHookEx
DeferWindowPos
DefWindowProcW

mprmeui

_Eps
_Strcoll
_Stof
_Snan
_Strxfrm
_Dtest
_FSnan
_Getctype

comdlg32

FindTextA
ChooseColorA

wininet

HttpQueryInfoA
InternetReadFile
InternetCrackUrlA

oleaut32

SafeArrayGetLBound
VariantCopy
CreateErrorInfo
VariantClear
SetErrorInfo
SafeArrayUnaccessData

advapi32

RegDeleteValueA
RegDeleteKeyA
RegFlushKey

comctl32

ImageList_GetDragImage
ImageList_SetIconSize

imm32

ImmSetCompositionWindow

version

GetFileVersionInfoSizeA

shell32

ShellExecuteA

ole32

OleSetMenuDescriptor
OleSetClipboard

Exports

Exports

AdsTypeToLdapTypeCopyTime
GetDisplayName
CreateProcessNotify
DllClientCleanup
ConvertU2TrusteeToSid
GetPermLayers
AllocADsMem
AdsTypeToLdapTypeCopyGeneralizedTime
FindSearchTableIndex
lodcll32
DllClientStartup
GetLDAPTypeName
ConvertSidToU2Trustee
BuildADsParentPathFromObjectInfo
ConvertSidToString
GetDefaultServer
AllocADsStr
FreeObjectInfo
SdbCloseApphelpInformation
BuildADsPathFromLDAPPath
BerBvFree

Sections

.text
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9e0fadadc63f8b508ba54626ac27ca0

Headers

File Characteristics

Imports

kernel32

gdi32

user32

mprmeui

comdlg32

wininet

oleaut32

advapi32

comctl32

imm32

version

shell32

ole32

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 56KB

.rdata Size: 4KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 53KB - Virtual size: 56KB

.rdata
Size: 4KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB