2d14ba9357a49edad90ab94dbd9c1795

Sharing

Copy URL Twitter E-mail

General

Target

2d14ba9357a49edad90ab94dbd9c1795
Size

40KB
MD5

2d14ba9357a49edad90ab94dbd9c1795
SHA1

93c8d33aa1dc30dd0992dad0a3c7e25d4d7acae6
SHA256

4895c3c7a0e00f7f7d6c6e90fbfc4630c725268cf3f6caa74f969998536ab0b9
SHA512

9c7cf0282983548874c35750f60e45c7147bd4b201cb30b6ef3e00640c2f9015e5cfcbb7b6b9b036d051d91435af6bd1fa9303f945901e02f711ac00a28cdb9a
SSDEEP

384:Lqx+Pz1NyRsmNQt8N4DgyAGhhEfRBoJdJgof1fu6RpF3nnt1MMjwg:Ox+P+qUi8N4DEDeJV1fu6RP3MMjw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d14ba9357a49edad90ab94dbd9c1795

Files

2d14ba9357a49edad90ab94dbd9c1795
.dll windows:4 windows x86 arch:x86

5ed0105ee5b747e531ad6133ce4b16cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2846
ord537
ord4129
ord5710
ord926
ord924
ord922
ord2764
ord6648
ord2915
ord540
ord535
ord858
ord6663
ord860
ord4278
ord800
ord1168
ord2818
ord939
ord6877

msvcrt

_adjust_fdiv
malloc
_initterm
free
strstr
strncmp
_stricmp
printf
rand
strtok
strchr
_mbscmp
exit
__CxxFrameHandler
atoi
time
srand

kernel32

ExitThread
CreateThread
GetSystemDirectoryA
Process32Next
Process32First
Sleep
GetCurrentProcess
GlobalMemoryStatus
GetVersionExA
GetCurrentProcessId
GetTickCount
HeapAlloc
GetProcessHeap
CloseHandle
TerminateProcess
TerminateThread
OpenProcess
GetTempPathA
CreateToolhelp32Snapshot
CreateProcessA

user32

ExitWindowsEx
wsprintfA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenServiceA
DeleteService
OpenSCManagerA

urlmon

URLDownloadToFileA

ws2_32

sendto
gethostbyname
inet_addr
htons
setsockopt
WSASocketA
WSAStartup
htonl
gethostname
connect
socket
send
inet_ntoa
closesocket
WSAGetLastError
recv
__WSAFDIsSet
select

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ed0105ee5b747e531ad6133ce4b16cd

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

urlmon

ws2_32

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 243KB

.rsrc Size: 4KB - Virtual size: 864B

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 243KB

.rsrc
Size: 4KB - Virtual size: 864B

.reloc
Size: 4KB - Virtual size: 1KB