436d68bb33b22916f02778b1485a09d6

Sharing

Copy URL Twitter E-mail

General

Target

436d68bb33b22916f02778b1485a09d6
Size

233KB
MD5

436d68bb33b22916f02778b1485a09d6
SHA1

facee5fd1f88556cb23f3e32d2100e7333a6146f
SHA256

791d5b538bfab3adafddd9d52cb1dbbce8b0e0885331babf851f9f9358f73059
SHA512

2678ff2eeaab0f1329e8f9be063b1c9524f8a393eca8e84fc0312da16c359372db46c4a702f9f92a224020ea7dfe422a326c0a6f6fbd26171bcbd1705fb92a42
SSDEEP

6144:eoP7ph/0GzA8DGZJK9Uae1paOEdpPOXMt6ONoJQ:eoP7phzA8DC/UbhOJQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
436d68bb33b22916f02778b1485a09d6

Files

436d68bb33b22916f02778b1485a09d6
.dll windows:4 windows x86 arch:x86

36247f41286884c6798bf13c6bd8e1ba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoGetContextToken
StgCreateDocfileOnILockBytes

kernel32

MoveFileA
GetDateFormatA
VirtualAlloc
IsBadReadPtr
LocalAlloc
ResetEvent
SetEndOfFile
GetLastError
ReadFile
LoadLibraryA
GetCommandLineW
GetModuleHandleA
ExitThread
ExitProcess
GetVersionExA
GetProcAddress
GetACP
GlobalAlloc

msvcrt

wcsncmp
pow
srand
_acmdln
cos
rand
wcscspn

user32

GetKeyNameTextA
GetKeyState
GetIconInfo

shell32

SHGetFolderPathA
SHGetFileInfoA
SHFileOperationA

gdi32

BitBlt
GetClipBox

comdlg32

FindTextA

shlwapi

SHEnumValueA
SHDeleteKeyA
PathGetCharTypeA
PathIsDirectoryA
SHQueryValueExA
SHGetValueA
SHQueryInfoKeyA
PathIsContentTypeA

comctl32

ImageList_DragShowNolock
ImageList_GetBkColor
ImageList_DrawEx
ImageList_Create
ImageList_Write

advapi32

RegDeleteKeyA
GetUserNameA
RegEnumKeyA
RegEnumValueA

oleaut32

SafeArrayPtrOfIndex
GetErrorInfo
VariantChangeType
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayGetElement
RegisterTypeLib
SafeArrayCreate

version

GetFileVersionInfoSizeA
VerFindFileA

Sections

CODE
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 734B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 158KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36247f41286884c6798bf13c6bd8e1ba

Headers

File Characteristics

Imports

ole32

kernel32

msvcrt

user32

shell32

gdi32

comdlg32

shlwapi

comctl32

advapi32

oleaut32

version

Sections

CODE Size: 57KB - Virtual size: 57KB

.rdata Size: 1024B - Virtual size: 734B

.data Size: 8KB - Virtual size: 8KB

.adata Size: 1024B - Virtual size: 748B

.gdata Size: 158KB - Virtual size: 226KB

.bdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 996B

.reloc Size: 1KB - Virtual size: 1KB

CODE
Size: 57KB - Virtual size: 57KB

.rdata
Size: 1024B - Virtual size: 734B

.data
Size: 8KB - Virtual size: 8KB

.adata
Size: 1024B - Virtual size: 748B

.gdata
Size: 158KB - Virtual size: 226KB

.bdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 996B

.reloc
Size: 1KB - Virtual size: 1KB