49167cb806873f6b3103ad452277181e

Sharing

Copy URL

Twitter E-mail

General

Target

49167cb806873f6b3103ad452277181e
Size

132KB
MD5

49167cb806873f6b3103ad452277181e
SHA1

022f94c52e66ccfd136d323947eee13b3e3ac1e7
SHA256

54dee5483c0f4f8c78a92a1370c559e4b9a0b8f853b65efb13edcfb619c87767
SHA512

0b6ab3a5328c9fa1d7e0303894cf692d705edd489ed3a31f33ef1ddcb9987d5bd19c18fb378038b62dd31adb215ab73bcac250814b923e0397cf9961cfb2cff6
SSDEEP

1536:u22/ziFF6S//ppqHIdXHw09kghzT4aPbEJaDjvoe3BBOs/AsqpJqN8gBblGLjoyb:uBmbppqHuXJ9ko3Lvoym+lBBG3b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49167cb806873f6b3103ad452277181e

Files

49167cb806873f6b3103ad452277181e
.dll windows:4 windows x86 arch:x86

6eb81faab49bf28990b0f5c208ca04a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueW
LookupAccountSidW
LookupPrivilegeValueA
InitializeSecurityDescriptor
ChangeServiceConfigA
RegEnumKeyExA
RegQueryValueExW
RegQueryInfoKeyW
AllocateAndInitializeSid
RegDeleteValueA
RegFlushKey
RegDeleteKeyA
RegQueryInfoKeyA
RegQueryValueExA
FreeSid
RegCreateKeyExW
RegEnumKeyExW

kernel32

LoadLibraryA
IsValidLocale
GetProcAddress
GetHandleInformation
GetModuleHandleA
VirtualAlloc
GetShortPathNameW
FindResourceW
GlobalLock
lstrcatA
VirtualFree
HeapCreate
InterlockedDecrement
CreateThread
SetFilePointer
GetCurrentDirectoryA
FormatMessageA
CompareStringA
InterlockedCompareExchange
LoadLibraryExW
LCMapStringA
SetHandleCount
GetProcessHeap
CreateProcessW
ExitProcess
GetSystemTime
HeapAlloc
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
HeapDestroy
HeapFree
DeleteCriticalSection
FatalAppExitA
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
CloseHandle
CreateFileA
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers
SetStdHandle
SetEndOfFile
ReadFile
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind

Exports

Exports

mkhujwmd

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6eb81faab49bf28990b0f5c208ca04a6

Headers

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 62KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 52KB - Virtual size: 54KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 64KB - Virtual size: 62KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 52KB - Virtual size: 54KB

.reloc
Size: 8KB - Virtual size: 7KB