38b41ec6ef87094a1b3d689e4ed6a98c

General

Target

38b41ec6ef87094a1b3d689e4ed6a98c
Size

28KB
MD5

38b41ec6ef87094a1b3d689e4ed6a98c
SHA1

3e303576ff795c034e1f97885fb1ef00bff42df4
SHA256

cfd52ff69a86389c8418ef6b6bba6df9297e3b978ff138a8bb31649437d29567
SHA512

eab43c7b08fc1d818ad8b5fe73139ebf3bc84c00c94b5834ea4825644d06c0e19fac16bb4ea6e2182563ea012d651fb81218d52e1b559d73b99d9920cee8b9cd
SSDEEP

192:/96OhCh0Pq5wCAMOFbcipJI4JHTp28qvKhVl/dVzmG30eunpF:/9iAJCAMarJp5p9PmG6p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38b41ec6ef87094a1b3d689e4ed6a98c

Files

38b41ec6ef87094a1b3d689e4ed6a98c
.dll windows:4 windows x86 arch:x86

89e66a8b9dfcbcbdee371a146e02e09f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1138
ord1182
ord823
ord342
ord1247
ord1253
ord1168

msvcrt

_adjust_fdiv
malloc
free
_findnext
_findfirst
_chdir
_chdrive
fclose
fread
ftell
fseek
_initterm
realloc
printf
fwrite
fopen
_stricmp

kernel32

DeleteFileA
SetFileAttributesA
CloseHandle
Process32Next
Process32First
TerminateProcess
OpenProcess
GetFileAttributesA
CreateToolhelp32Snapshot
TerminateThread
SuspendThread
GetSystemDirectoryA
GetLastError
CreateThread
Sleep
GetCurrentThread
GetCurrentProcess

user32

SetCursorPos
GetMessageExtraInfo
ExitWindowsEx
mouse_event

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteA

wsock32

socket
setsockopt
WSAStartup
inet_ntoa
htons
recv
connect
select
closesocket
send
gethostbyname

winmm

waveInUnprepareHeader
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveInClose

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1022B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89e66a8b9dfcbcbdee371a146e02e09f

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

wsock32

winmm

Sections

.text Size: 8KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 968B

.reloc Size: 4KB - Virtual size: 1022B

.text
Size: 8KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 968B

.reloc
Size: 4KB - Virtual size: 1022B