36edd2f3e54c86c62316265036de2579

Sharing

Copy URL Twitter E-mail

General

Target

36edd2f3e54c86c62316265036de2579
Size

68KB
MD5

36edd2f3e54c86c62316265036de2579
SHA1

4e5a58fc3b55787e6fcc4ab893bf34960aa6268e
SHA256

47212e6e360e62d783c7963a1734b5a683d228d723ca815af5ae2e3a08e9c42c
SHA512

4829d5f80a30c28ba4728b6df7698a88b6007803734f5c32ec4bf23e13b82505eb73699833629834cfa32b9626a3957ecd4ecaa72770cd6206c7173b7fa1fa5a
SSDEEP

1536:mTzD7As0er5UQq9hm2uR5WyglgGHPkgY7UGrfFcbxZE1IONGnToIf2r1:gznAsvNUQOhPu+ygXkvYmWxSNyTBfA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36edd2f3e54c86c62316265036de2579

Files

36edd2f3e54c86c62316265036de2579
.dll windows:4 windows x86 arch:x86

0d304b0a9670c649bdf39fd24bdbcffb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextW
EnumWindows
wsprintfA
GetWindowThreadProcessId
IsWindowVisible
ExitWindowsEx

kernel32

Sleep
EnterCriticalSection
FreeLibrary
GetComputerNameW
GetProcAddress
GetVersionExA
GlobalAlloc
GlobalFree
GlobalReAlloc
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
RtlZeroMemory
lstrlenW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
SetErrorMode
GetFileSize
GetLastError
GetLogicalDriveStringsW
ReadFile
RemoveDirectoryW
ResetEvent
SetEvent
SetFileAttributesW
SetFilePointer
WaitForSingleObject
WriteFile
lstrcatW
lstrcmpA
lstrcmpW
lstrcpyW
CreateToolhelp32Snapshot
Module32FirstW
RtlMoveMemory
Process32FirstW
Process32NextW
TerminateProcess
CreatePipe
CreateProcessW
GetSystemDirectoryW
GlobalSize
WideCharToMultiByte
lstrcatA
lstrcmpiW
lstrlenA
InitializeCriticalSection
GetCurrentProcess
DeleteCriticalSection
CreateThread
CreateEventA
CloseHandle
GetFileAttributesW
OpenProcess

ws2_32

select
recv
htons
gethostbyname
send
closesocket
__WSAFDIsSet
WSAStartup
WSACleanup
socket
WSACloseEvent
WSACreateEvent
WSAGetOverlappedResult
WSARecv
WSASend
connect
WSAWaitForMultipleEvents

msvcrt

memcpy
free
memset
malloc
wcstok
swprintf
sscanf

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
StartServiceA
RegSetValueExW
EnumServicesStatusW
OpenSCManagerA
OpenServiceW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ControlService
DeleteService

shell32

ShellExecuteW

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d304b0a9670c649bdf39fd24bdbcffb

Headers

File Characteristics

Imports

user32

kernel32

ws2_32

msvcrt

advapi32

shell32

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1KB - Virtual size: 17KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1KB - Virtual size: 17KB

.reloc
Size: 2KB - Virtual size: 1KB