515a2f1c87453306442386eb1452861d

Sharing

Copy URL Twitter E-mail

General

Target

515a2f1c87453306442386eb1452861d
Size

171KB
MD5

515a2f1c87453306442386eb1452861d
SHA1

1bfa557f2ce1ce10b231ef67d1c0377889439905
SHA256

55fab393ca755cb1bcc3e8efb7ea7ed49d560fa4251b56ff3b5c6a2400cf5f93
SHA512

b9fc79a9f82f2aba2862debc1a9109e2157a7e3ba3f98ca6e37a028e82509d4a368f7975cc42e3d8814539ba69f4eb9a2760983e6457fdb324a2ad7add7d71ba
SSDEEP

3072:lHUbFVzEtYRpq+eczMVSkrJiSYTF2VIKOr2ZA3XhvUuwU4ineHlBdiqzNND3SsH:ljtOqLczirTIuOLpUbiqXl1J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
515a2f1c87453306442386eb1452861d

Files

515a2f1c87453306442386eb1452861d
.dll windows:5 windows x86 arch:x86

764620afe9c2c31380952037d92c6099

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

?terminate@@YAXXZ
sscanf
_wcslwr
wcsncpy
__setusermatherr
__set_app_type
__p__commode
wcstol
__pioinfo
_CxxThrowException
__p__fmode
isxdigit
_vsnprintf
strncmp
_itoa

kernel32

CreateDirectoryW
GetCurrentThreadId
QueryPerformanceCounter
GetDriveTypeA
GetSystemTimeAsFileTime
ExitProcess
FindResourceA
FindResourceW
GetExitCodeProcess
IsBadReadPtr
GetCurrentThread
SetLastError
GetCurrentProcessId
GetVersion
FreeEnvironmentStringsA
GetProcessHeap
CreateEventW
CreateFileA
OpenMutexW
GetModuleHandleW
DuplicateHandle
HeapSize
GetCurrentProcess
VirtualAlloc
DeviceIoControl

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
VerFindFileW

ole32

ReleaseStgMedium
CLSIDFromString
StringFromIID
CoTaskMemRealloc
CoGetMalloc
CoFreeUnusedLibraries
CoRevokeClassObject
CLSIDFromProgID
CoCreateGuid
PropVariantClear
CoGetClassObject
CoInitialize
CoCreateInstanceEx
ProgIDFromCLSID
CreateDataAdviseHolder

shlwapi

SHSetValueW
SHDeleteValueA
StrCpyNW
PathRemoveFileSpecA
StrToIntExW
SHGetValueW
StrStrIA
PathStripToRootA
StrStrW
PathStripToRootW
SHStrDupW

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

764620afe9c2c31380952037d92c6099

Headers

File Characteristics

Imports

msvcrt

kernel32

version

ole32

shlwapi

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 51KB - Virtual size: 242KB

.idata Size: 61KB - Virtual size: 61KB

.reloc Size: 512B - Virtual size: 490B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 51KB - Virtual size: 242KB

.idata
Size: 61KB - Virtual size: 61KB

.reloc
Size: 512B - Virtual size: 490B