49bb9b8f08438c9b87845c296c60f9d6

Sharing

Copy URL Twitter E-mail

General

Target

49bb9b8f08438c9b87845c296c60f9d6
Size

216KB
MD5

49bb9b8f08438c9b87845c296c60f9d6
SHA1

f43f8228f024fb4822716592e3020b6feeaeb887
SHA256

e44be05d517c06b89bc174cb53efe0a9dd585bfe472701e1354bdeeb8e27c835
SHA512

bdb37bb8e22277640ae27f89ec28dfc72da589561c068d6dfb0a734c30de69b4785415dcb522e53ae072d3078c14c4eb5b73d7fee0de5d8f1e9e4ab1dc158e4f
SSDEEP

6144:Pkgk0k3La2cZ+TLiaKC/ZRk/BU5VtUo+:Pk30k3s0LUCI/BJo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49bb9b8f08438c9b87845c296c60f9d6

Files

49bb9b8f08438c9b87845c296c60f9d6
.dll windows:4 windows x86 arch:x86

28c0bfe2843e21bc0ff2983932fc0dad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

pncrt

memset
_putenv
_adjust_fdiv
_onexit
rand
_stricmp
_stat
memmove
__dllonexit
_initterm
realloc
_mbctype
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_assert
free
malloc
_ftol
??2@YAPAXI@Z
??3@YAXPAX@Z
srand
??1type_info@@UAE@XZ
memcpy
_purecall
sscanf
sprintf
printf
strchr
atoi
_fsopen
fread
strrchr
strncpy
__CxxFrameHandler
strstr
fclose
fwrite
fopen
_splitpath
??1exception@@UAE@XZ
_CxxThrowException
_strnicmp

ole32

CoUninitialize
CoInitialize
CoCreateInstance

user32

DefWindowProcA
PeekMessageA
TranslateMessage
PostQuitMessage
PostMessageA
GetMessageA
DispatchMessageA
RegisterWindowMessageA
PostThreadMessageA
GetClassInfoExA
CreateWindowExA
MsgWaitForMultipleObjects
CharLowerA
CharNextA
GetSystemMetrics
UnregisterClassA
DestroyWindow
RegisterClassExA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

oleaut32

SysFreeString
SysAllocString
GetErrorInfo

kernel32

QueryPerformanceCounter
LocalFree
GetLastError
DeleteFileA
InterlockedDecrement
InterlockedIncrement
WaitForSingleObject
ResetEvent
SetEvent
InterlockedExchange
Sleep
CloseHandle
CreateEventA
GetCurrentThreadId
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameA
GetTickCount
QueryPerformanceFrequency
WideCharToMultiByte
ExitProcess
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection

Exports

Exports

CanUnload2
RMACreateInstance
SetDLLAccessPath

Sections

.text
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28c0bfe2843e21bc0ff2983932fc0dad

Headers

File Characteristics

Imports

pncrt

ole32

user32

advapi32

oleaut32

kernel32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 110KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 112KB - Virtual size: 110KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB