4ef87ac2fc99f6df923c348c6cf90d03

Sharing

Copy URL

Twitter E-mail

General

Target

4ef87ac2fc99f6df923c348c6cf90d03
Size

19KB
MD5

4ef87ac2fc99f6df923c348c6cf90d03
SHA1

80125fbeb8ae2bddffb02e18fe311995f431a09f
SHA256

59b94a3169f7aa65794df84bed6eb35fb963230c30e50f22f75fc6dff0b393fb
SHA512

e5c56646042148ab4254a10d41c27f051c8e41ada6b246b6e8d7e439bd976791b28c9ab7f604b46bf7f639b56ac769d385cf40cae7e9c6d9613e9c120a313cd6
SSDEEP

384:gFCiLbX8CxjZ8+0XplVucMHuq6TlFhnrM:g3sC8pXPbMOq6zu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ef87ac2fc99f6df923c348c6cf90d03

Files

4ef87ac2fc99f6df923c348c6cf90d03
.dll windows:4 windows x86 arch:x86

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegSetValueExA

kernel32

CreateMutexA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OutputDebugStringA
ReleaseMutex
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
malloc
memcpy
sprintf
vfprintf

Exports

Exports

CalcHash
CalcHashW
DynamicImports
GetKernel32
Inject@4
Injecting
IsPatched
IsStarted
Kernel32Base
KernelGetProcAddressEx
LoopInject@4
MapFileToMemory
PatchDLL
Peb
ResolveDynamicImports
__CloseHandle
__ConnectNamedPipe
__CopyFile
__CreateEvent
__CreateFile
__CreateFileMapping
__CreateMailslot
__CreateNamedPipe
__CreateProcess
__CreateRemoteThread
__CreateService
__CreateToolhelp32Snapshot
__DeleteFile
__ExitProcess
__FindResource
__GetCommandLine
__GetCurrentProcessId
__GetFileSize
__GetFullPathName
__GetKernelObjectSecurity
__GetLongPathName
__GetMailslotInfo
__GetModuleFileName
__GetModuleHandle
__GetProcAddress
__GetProcessId
__GetSystemDirectory
__GetTempFileName
__GetTempPath
__GetTickCount
__GetUserNameW
__GlobalAlloc
__GlobalFree
__LoadLibrary
__LoadResource
__LockResource
__MapViewOfFile
__MessageBox
__NtClose
__NtCreateFile
__NtCreateSection
__NtExtendSection
__NtMapViewOfSection
__NtOpenDirectoryObject
__NtOpenFile
__NtOpenSection
__NtUnmapViewOfSection
__ObReferenceObjectByHandle
__OpenEvent
__OpenProcess
__OpenSCManager
__OpenService
__OpenThread
__Process32First
__Process32Next
__ReadFile
__ReadProcessMemory
__RegOpenKey
__RegQueryValueEx
__ResetEvent
__ResumeThread
__RtlAdjustPrivilege
__RtlInitUnicodeString
__RtlNtStatusToDosError
__SHGetFolderPath
__SetEvent
__SetMailslotInfo
__SizeofResource
__Sleep
__StartService
__SuspendThread
__Thread32First
__Thread32Next
__UnmapViewOfFile
__VirtualAlloc
__VirtualAllocEx
__VirtualFree
__VirtualFreeEx
__WaitForSingleObject
__WinExec
__WriteFile
__WriteProcessMemory
__ZwCreateDirectoryObject
__ZwCreateFile
__ZwCreateSection
__ZwLoadDriver
__ZwMakeTemporaryObject
__ZwQueryInformationProcess
__ZwUnloadDriver
___memset
___strlwr
___strupr
___wcslen
___wcsncpy
__atoi
__lstrcpyn
__lstrlen
__mbstowcs
__memcmp
__memcpy
__memset
__puts
__rand
__srand
__sscanf
__strlwr
__strrchr
__strstr
__time
__wcslen
__wcsncpy
__wsprintf
_strchr
advapi32
emul
kernel32
m2
msvcrt
ntdll
shell32
szAutoloadName
szAutoloadPath
szDriverPath
szIsAutoload
user32
xwcslwr

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 708B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 2KB

.rdata Size: 1024B - Virtual size: 900B

.eh_fram Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 708B

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 1024B - Virtual size: 1016B

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 1024B - Virtual size: 972B

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 900B

.eh_fram
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 708B

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 1016B

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 1024B - Virtual size: 972B