4b6f011d8c2e684dff66a6238b20c2c7

Sharing

Copy URL Twitter E-mail

General

Target

4b6f011d8c2e684dff66a6238b20c2c7
Size

188KB
MD5

4b6f011d8c2e684dff66a6238b20c2c7
SHA1

69487cfc62569fa5c9c337d570e73bce4e5e38e1
SHA256

7628d4c1c4c0d9f885ba468e9f6b61bf1c8e99672e35aad53ec84d2b9338ffc6
SHA512

8168e8acab17a3373a90552e85fd937e2ef9d4e602973102ebb741d8f08a82f61be1634f69fc14aadcdd2d52fddfc280940adc4a5ae210ad1d719e5d32642042
SSDEEP

3072:8e11crVUb3I8OZiwoquYVYzkInvGoe7NZOOBS8UtoNXXHANoH6dHkxW7EvmRTQhp:91Ds8OCGCzDnc7XOQSdCNXXkoadT52o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b6f011d8c2e684dff66a6238b20c2c7

Files

4b6f011d8c2e684dff66a6238b20c2c7
.dll windows:4 windows x86 arch:x86

1f49fe04dedbad9e865cc6496119d95a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileMappingA
DeviceIoControl
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetLastError
GetShortPathNameA
GetStdHandle
GetTickCount
GetTimeFormatA
GetVersion
GetWindowsDirectoryA
GlobalAlloc
HeapReAlloc
InterlockedExchange
IsBadCodePtr
IsValidLocale
LoadLibraryExA
LoadResource
LocalFree
MoveFileExA
ResumeThread
RtlUnwind
SetLastError
SetThreadPriority
Sleep
SystemTimeToFileTime
TlsGetValue
TlsSetValue
WaitForSingleObject
WriteConsoleA
lstrcmpiA

user32

CharPrevA
CopyRect
CreateDialogParamA
CreateWindowExA
DefWindowProcA
DestroyIcon
DrawFocusRect
EndPaint
EnumChildWindows
FindWindowA
GetActiveWindow
GetDlgItemTextA
GetWindow
IntersectRect
IsChild
IsDlgButtonChecked
IsRectEmpty
LoadStringA
MessageBoxA
PeekMessageA
RegisterClassA
ReleaseCapture
ReleaseDC
ScreenToClient
SetRect
SetTimer
SetWindowPos
SystemParametersInfoA
TrackPopupMenu
WinHelpA

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
ChangeServiceConfigA
CloseServiceHandle
ControlService
DeleteService
FreeSid
GetSecurityDescriptorControl
GetTokenInformation
GetUserNameA
InitializeSecurityDescriptor
LockServiceDatabase
LookupAccountSidA
LookupPrivilegeValueA
OpenProcessToken
OpenServiceA
QueryServiceConfig2A
QueryServiceStatus
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetSecurityDescriptorDacl
SetServiceStatus
StartServiceCtrlDispatcherA

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f49fe04dedbad9e865cc6496119d95a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 171KB - Virtual size: 170KB

.data Size: 4KB - Virtual size: 148KB

.bss Size: - Virtual size: 3KB

.data1 Size: 6KB - Virtual size: 6KB

.idata Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 896B

.text
Size: 171KB - Virtual size: 170KB

.data
Size: 4KB - Virtual size: 148KB

.bss
Size: - Virtual size: 3KB

.data1
Size: 6KB - Virtual size: 6KB

.idata
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 896B