3e61d0bed00fdfadc732b3e8285364c6

Sharing

Copy URL Twitter E-mail

General

Target

3e61d0bed00fdfadc732b3e8285364c6
Size

89KB
MD5

3e61d0bed00fdfadc732b3e8285364c6
SHA1

1824dc217b1e6116353d6c551427db462759f8b2
SHA256

18c636364ce25a86c6df6eb982ca0de96080dd5735eb849bc10597bf57a9fd77
SHA512

f0ee05271210ed50f84d58980215522470f7a74088460d91e07ee6ae9b8d17704bd15db5cc8ea3d5eb9b2fe421b313e4dfcfda5fc2a4bb2b99bf91dfd36c91fd
SSDEEP

1536:YdC43h5GygwZMvezhF/cjaFalAHa1SDFR4SkMd5RgGKRCmWLyIYRd25kcPC:YdjDGygw18DAHa1SDFR4SkMHRkRCmYux

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e61d0bed00fdfadc732b3e8285364c6

Files

3e61d0bed00fdfadc732b3e8285364c6
.dll windows:4 windows x86 arch:x86

315c19d030b19439dffd3a8c6d16208a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

realloc
_snprintf
_initterm
time
strlen
srand
rand
malloc
strrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsstr
_strlwr
sscanf
memset
strcat
strstr
memcpy
wcsncpy
wcslen
strcpy
__CxxFrameHandler
strchr
strncpy
atoi
free
_except_handler3
_adjust_fdiv
_strcmpi
_stricmp

kernel32

WideCharToMultiByte
DisableThreadLibraryCalls
ExitProcess
CreateMutexA
GetLastError
WinExec
CloseHandle
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
OpenEventA
ReadFile
OutputDebugStringW
WritePrivateProfileStringA
VirtualProtect
GetCommandLineA
GetPrivateProfileStringA
IsBadReadPtr
lstrlenW
VirtualProtectEx

user32

wsprintfA
wvsprintfA

wininet

InternetReadFile

urlmon

URLDownloadToCacheFileA

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DDK0
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DDK1
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.cOU
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

315c19d030b19439dffd3a8c6d16208a

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

urlmon

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 20KB - Virtual size: 25KB

DDK0 Size: 4KB - Virtual size: 3KB

DDK1 Size: 16KB - Virtual size: 14KB

.reloc Size: 4KB - Virtual size: 3KB

.cOU Size: 512B - Virtual size: 512B

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 20KB - Virtual size: 25KB

DDK0
Size: 4KB - Virtual size: 3KB

DDK1
Size: 16KB - Virtual size: 14KB

.reloc
Size: 4KB - Virtual size: 3KB

.cOU
Size: 512B - Virtual size: 512B