50539abe1256dfe3c21b34e39e2076fb

Sharing

Copy URL

Twitter E-mail

General

Target

50539abe1256dfe3c21b34e39e2076fb
Size

152KB
MD5

50539abe1256dfe3c21b34e39e2076fb
SHA1

3eab4b33d2f687f63380db179be9fa50ff43e9d3
SHA256

011af8372c10a904882b446dd8b200311d697031420bb25da10b9721900b681c
SHA512

8227c6db11317f3c27c2953e605ca6f9f540bb3eec157641c21eea6c40fb5ff8ea3f38c3997802473f18353ecc78d08a6477eb8d94f716fc2788f706f5d852c3
SSDEEP

3072:X0cGfVKTkdu+TwxL8dNN6yHQF8kOVniNllBAB1g7MweAVPtK5MEj4CYNZsE:XAfVKawqd7HQmdellBAB1ggweAhg5DUX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50539abe1256dfe3c21b34e39e2076fb

Files

50539abe1256dfe3c21b34e39e2076fb
.dll windows:4 windows x86 arch:x86

12e5158a3fbbdbb97f792fa38e60aea6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
GetCurrentProcess
GetLastError
CreateMutexW
GetComputerNameA
CreateFileA
CopyFileA
CloseHandle
ReadProcessMemory
CreateDirectoryA
SetLastError
CreateProcessA
InterlockedIncrement
LeaveCriticalSection
GetTickCount
CreateEventA
InterlockedDecrement
GetProcessHeap
HeapFree
GlobalFree
WaitForSingleObject
GetModuleFileNameA
MapViewOfFile
LocalFree
GlobalAlloc
GetProcAddress
ExitProcess
GetVolumeInformationA
OpenEventA
InterlockedCompareExchange
GetCommandLineA
HeapAlloc
OpenFileMappingA
EnterCriticalSection
TerminateProcess
WriteProcessMemory
Sleep
LoadLibraryA
GetModuleHandleA
CreateFileMappingA
UnmapViewOfFile

ole32

CoCreateInstance
CoUninitialize
OleSetContainedObject
CoCreateGuid
CoInitialize
CoTaskMemAlloc
CoSetProxyBlanket
OleCreate

user32

GetWindow
CreateWindowExA
GetSystemMetrics
GetClassNameA
SetWindowsHookExA
GetWindowThreadProcessId
SendMessageA
GetMessageA
SetWindowLongA
TranslateMessage
ScreenToClient
PostQuitMessage
UnhookWindowsHookEx
KillTimer
SetTimer
RegisterWindowMessageA
GetWindowLongA
DefWindowProcA
ClientToScreen
PeekMessageA
FindWindowA
GetCursorPos
DestroyWindow
DispatchMessageA
GetParent

oleaut32

SysStringLen
SysAllocString
SysFreeString
SysAllocStringLen

shlwapi

StrStrIW
UrlUnescapeW

advapi32

OpenProcessToken
RegOpenKeyExA
RegDeleteValueA
DuplicateTokenEx
RegCloseKey
RegDeleteKeyA
SetTokenInformation
RegSetValueExA
RegQueryValueExA
GetUserNameA
RegCreateKeyExA

shell32

SHGetFolderPathA

Exports

Exports

AppHelpapi

Sections

.text
Size: 124KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12e5158a3fbbdbb97f792fa38e60aea6

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 120KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 976B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 124KB - Virtual size: 120KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 976B

.reloc
Size: 8KB - Virtual size: 6KB