3df8b7bf6e9bac6c7b68ca6f4e344526

Sharing

Copy URL Twitter E-mail

General

Target

3df8b7bf6e9bac6c7b68ca6f4e344526
Size

99KB
MD5

3df8b7bf6e9bac6c7b68ca6f4e344526
SHA1

aa0b781cfd0019fe2d2a3ee6bde7243fe03a0e7a
SHA256

a7bcd5aa1341b0df2436dbbfc279b0af1448f2c1933abcd3be2930569fea62ce
SHA512

d27c64a48025a0d4d9a10228c39791a88110fb1b56bf216bdde14f36d882dd382db13fe501035f594d9de8d6ea9401275446b4b99c53a18744ac2de52bdd970e
SSDEEP

1536:WsBnMigG1ebSem3uyQSC+TEkq6wr4SDwVTJx2oFD0w9q2I:9lMi/1ebALQSCbFrB0VT72oOx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3df8b7bf6e9bac6c7b68ca6f4e344526

Files

3df8b7bf6e9bac6c7b68ca6f4e344526
.dll windows:4 windows x86 arch:x86

b5f2d0edea23513996c99c424058465c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
SetPriorityClass
GetCurrentProcess
FindClose
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
DeleteFileA
lstrcmpiA
SetThreadPriority
lstrcpyA
CreateProcessA
GetDiskFreeSpaceA
GetDriveTypeA
GlobalMemoryStatus
lstrcatA
GetVersionExA
GetSystemInfo
GetComputerNameA
Sleep
lstrlenA
lstrcmpA
CopyFileA
GetFileAttributesA
GetTimeZoneInformation
VirtualFree
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
RtlUnwind
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
CreateThread
GetSystemTime
GetLocalTime
WideCharToMultiByte
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
SetLastError
TlsGetValue
TlsFree
ExitProcess
HeapDestroy
HeapCreate
SetFilePointer
WriteFile
HeapReAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetLastError
TerminateProcess
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW

user32

FindWindowA
IsWindowVisible
SendMessageA
MessageBoxA
ExitWindowsEx
ShowWindow
GetDesktopWindow
wsprintfA
IsWindow

winmm

mciSendCommandA

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
GetUserNameA
RegSetValueExA

shell32

SHFileOperationA

wsock32

ioctlsocket
htons
getprotobyname
socket
send
recv
connect
inet_ntoa
gethostname
gethostbyname
WSACleanup
WSAStartup
WSAGetLastError
closesocket

Exports

Exports

InstallPlugin
PluginVersion
TerminatePlugin

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 123B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5f2d0edea23513996c99c424058465c

Headers

File Characteristics

Imports

kernel32

user32

winmm

advapi32

shell32

wsock32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 17KB

.edata Size: 4KB - Virtual size: 123B

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 17KB

.edata
Size: 4KB - Virtual size: 123B

.reloc
Size: 8KB - Virtual size: 5KB