3fe5fceb0b55eff1352a7cde2f9a9d2a

Sharing

Copy URL Twitter E-mail

General

Target

3fe5fceb0b55eff1352a7cde2f9a9d2a
Size

58KB
MD5

3fe5fceb0b55eff1352a7cde2f9a9d2a
SHA1

29d616a43d7c00106933c8d86f9c6737bc8f859e
SHA256

bd22713bd62ca84da96dde0829cb3b134357730240ca4b8c67dbbea3bb300e9a
SHA512

4d560f416980ca383a18a3e7d0757c614226fa0fb60b077b0d2a022cd8431195433adf1d14272a912942a82beabde92126601165f058628b9b452bd950361f05
SSDEEP

1536:5v2hf5FUY/DSlj1noxJ9hZ+z2Hj6eh1xxWQV:BifD/DS8jzq2Hj6eh1rD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fe5fceb0b55eff1352a7cde2f9a9d2a

Files

3fe5fceb0b55eff1352a7cde2f9a9d2a
.dll windows:4 windows x86 arch:x86

1beb7a15b562cb3101fb27b053ae6f7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
longjmp
_setjmp3
vsprintf
_except_handler3
memmove
_purecall
_strlwr
strncmp
strncpy
strcat
strcpy
malloc
strlen
_iob
fprintf
strspn
strcspn
tolower
atoi
strcmp
isdigit
_strdup
strchr
sscanf
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_splitpath
memset
_itoa
memcpy
memcmp
strstr
strncat
__mb_cur_max
_isctype
_pctype
free

kernel32

FlushInstructionCache
GetCurrentProcess
GetProcAddress
VirtualProtect
CreateMutexA
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
LoadLibraryA
GetComputerNameA
FreeLibrary
VirtualQuery
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetTickCount
TlsSetValue
TlsGetValue
SetEvent
lstrlenA
lstrcatA
lstrcpyA
GetCurrentProcessId
TlsAlloc
TlsFree
GetModuleHandleA
GetModuleFileNameA
IsDebuggerPresent
CreateThread
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
TerminateThread
WaitForMultipleObjects
SetEndOfFile
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetVersionExA
lstrcpynA
GetVolumeInformationA

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
CharLowerA
wsprintfA
SendMessageA
FindWindowA

advapi32

CryptReleaseContext
CryptDeriveKey
CryptGetUserKey
CryptImportKey
CryptEncrypt
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptGenKey
CryptDestroyKey
CryptDecrypt

ws2_32

recv
send
closesocket
getpeername
ntohs
inet_ntoa
WSAGetLastError
gethostbyname
connect
WSARecv
WSASend

wininet

InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetReadFile
InternetQueryOptionA
HttpQueryInfoA
InternetOpenA
InternetCloseHandle

Exports

Exports

_fuckAllProcesses@8

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1beb7a15b562cb3101fb27b053ae6f7a

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ws2_32

wininet

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 7KB

.Shared Size: 512B - Virtual size: 12B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 7KB

.Shared
Size: 512B - Virtual size: 12B

.reloc
Size: 5KB - Virtual size: 4KB