44aee22e04ee9c14ed65d2223def2de4

Sharing

Copy URL

Twitter E-mail

General

Target

44aee22e04ee9c14ed65d2223def2de4
Size

18KB
MD5

44aee22e04ee9c14ed65d2223def2de4
SHA1

c594a1761190df407a4f3023f49b87348bff210e
SHA256

b3058617c8b9947f86d26e28975172901442b829ecb3f508895f9340e4abc633
SHA512

ee077030301be1f260d02293658ad02e3b0e466fee2d1e75472c3ac652d21505d6d5ee5fa644e4f6c737e4d57f85e65a39a06da4116622fbe3d4e4d2c6d3657b
SSDEEP

384:oh8t7bddzoYwvKS+/NKBxzi70U6c1W/W4d0uG1:o8JdzRwvKBgxo0XcOd0uG1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44aee22e04ee9c14ed65d2223def2de4

Files

44aee22e04ee9c14ed65d2223def2de4
.dll windows:4 windows x86 arch:x86

087cb03ce2f6ff3107dffd85d8f88882

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

_vsnprintf
ZwWriteFile
ZwReadFile
ZwCreateNamedPipeFile
ZwDeleteKey
ZwClose
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlInitUnicodeString
ZwOpenKey
ZwQueryValueKey
RtlImageNtHeader
RtlImageDirectoryEntryToData
RtlPrefixUnicodeString
strncpy
_strnicmp
_memicmp
_snwprintf
RtlCreateRegistryKey
strchr
sscanf
RtlRandom
ZwQueryInformationThread
ZwCreateMutant
_snprintf
ZwFsControlFile
memset
memcpy

wininet

InternetConnectA
InternetOpenA
InternetCrackUrlA
InternetGetLastResponseInfoA
InternetReadFile
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

shlwapi

PathRemoveExtensionA
PathFindFileNameA
SHRegSetUSValueW
PathFindFileNameW

psapi

GetMappedFileNameA

kernel32

MoveFileExA
IsBadCodePtr
IsBadReadPtr
GetExitCodeThread
WaitForSingleObject
GetModuleFileNameW
UnlockFile
LockFile
SetFileAttributesA
GetFileAttributesA
GetTempPathA
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
BindIoCompletionCallback
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetCurrentProcess
GetLastError
OutputDebugStringA
VirtualFree
TerminateThread
CloseHandle
DeleteFileA
SleepEx
Sleep
CreateThread
VirtualAlloc
GetCurrentThread
ExitThread
GetTickCount
SetUnhandledExceptionFilter

imagehlp

MapFileAndCheckSumA

Exports

Exports

ClearKey
CmdExec
CmdExecBotID
CmdExecBuild
CmdExecType
CmdExecVersion
CryptKeySet
DeleteKey
DeleteValue
FileDownload
FileDownloadUnxor
Knock
ModuleDownload
ModuleDownloadUnxor
ModuleLoad
ModuleUnload
ModulesVersionLog
SameFileVersion
SetCmdDelay
SetErrorsURL
SetFileVersion
SetLoadedURL
SetTimeout

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 165B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 842B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

087cb03ce2f6ff3107dffd85d8f88882

Headers

File Characteristics

Imports

ntdll

wininet

version

shlwapi

psapi

kernel32

imagehlp

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 165B

.rsrc Size: 1024B - Virtual size: 736B

.reloc Size: 1024B - Virtual size: 842B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 165B

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 1024B - Virtual size: 842B