48b0eab581d8d20810d5016de5ab0d81

General

Target

48b0eab581d8d20810d5016de5ab0d81
Size

34KB
MD5

48b0eab581d8d20810d5016de5ab0d81
SHA1

aab238f913cfca0624c9ed6775492e5e0ee8a2ea
SHA256

00867ec54b6e206c126f722d09c3d3d6cb47d13e61b4e4a0f7a2b333191eb46d
SHA512

fe33ac0ad0592e57ad3b20ed98e56cbf4ce1ebc62d30d7fc65f6be68c8a4c18c4a3ce12dc90c8c04a3b50ccd194bdc1561c51070115865519f6ca866a8c2de1e
SSDEEP

768:1hcQs6DpOvE2yuy+j9cfTPCirJ6eMyKfLopRK3JcPbEJQ4gjz:1hXVDp4EtuXj9QpgfKRK3J7JQ4Az

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48b0eab581d8d20810d5016de5ab0d81

Files

48b0eab581d8d20810d5016de5ab0d81
.dll windows:4 windows x86 arch:x86

243d376a4f017c44c1dec20140ee6207

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
SetEndOfFile
GetProcAddress
OpenProcess
lstrcpyA
lstrcatA
SetEvent
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
WideCharToMultiByte
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindNextFileA
FindFirstFileA
lstrcmpA
ResetEvent
CompareStringA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
GetTempFileNameA
GetFileAttributesA
AreFileApisANSI
CloseHandle
FindClose
CreateFileA
SetFilePointer

user32

wsprintfA

advapi32

CryptHashData
CryptDeriveKey
CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptAcquireContextA
CryptCreateHash
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptDecrypt

iphlpapi

GetAdaptersInfo

shell32

SHGetFolderPathA

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

243d376a4f017c44c1dec20140ee6207

Headers

File Characteristics

Imports

kernel32

user32

advapi32

iphlpapi

shell32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB