548231a9467187c76fc6538c09d182de

Sharing

Copy URL

Twitter E-mail

General

Target

548231a9467187c76fc6538c09d182de
Size

43KB
MD5

548231a9467187c76fc6538c09d182de
SHA1

8e550ab8b6d377b27bdcc4123736aff3693e8a87
SHA256

1eaedd86fbcb8a9c954f2506e4b39c8c3a0131d3da44369a9188d16985babf58
SHA512

68d485425cbf4721c205f9b810dba8b6ca64feec8b8c66f089331680eea4769aa547876461288040b2252f4c84046c9503d7434b1487745ecd1e944661fd268c
SSDEEP

768:+IgjbXdxAf+jua33sfIgxoSazgPyP4BACPDpD3wdA+VH1Bxk8IaCeudnv8gzMcl8:HB01eyP4BACPN3wdnxk8HuBvh5h6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
548231a9467187c76fc6538c09d182de

Files

548231a9467187c76fc6538c09d182de
.dll windows:4 windows x86 arch:x86

c88222211423ab521e6a2888fc51b9b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA

shlwapi

wnsprintfA
StrToIntA
StrStrA

ws2_32

ioctlsocket
WSAStartup
WSACleanup
WSASetLastError
select
getsockopt
__WSAFDIsSet
WSAGetLastError
gethostbyname
socket
setsockopt
connect
recv
send
shutdown
closesocket
sendto
inet_ntoa
recvfrom
getsockname
bind
inet_addr
htonl
htons

kernel32

ExitProcess
GetModuleFileNameA
GetWindowsDirectoryA
GetStartupInfoA
CreateProcessA
OpenThread
TerminateThread
GetExitCodeThread
lstrcpynA
GetVersion
SetFileAttributesA
lstrcpyA
GetEnvironmentVariableA
GetCurrentThread
SetThreadPriority
FreeLibraryAndExitThread
lstrlenA
HeapFree
GetLastError
IsBadWritePtr
HeapSize
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapValidate
lstrcatA
GetTimeZoneInformation
GetSystemTime
DeleteFileA
OpenFile
IsBadReadPtr
ExitThread
GetTickCount
Sleep
SetLastError
CloseHandle
GetCurrentThreadId
CreateThread
CreateMutexA
OpenMutexA
ReadFile
GetFileSize
CreateFileA
WriteFile
WaitForSingleObject
ReleaseMutex

user32

CharLowerA
wsprintfA

dnsapi

DnsExtractRecordsFromMessage_W
DnsQuery_A
DnsRecordListFree

shell32

ShellExecuteA

Exports

Exports

BG

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c88222211423ab521e6a2888fc51b9b2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

shell32

Exports

Exports

Sections

.text Size: 33KB - Virtual size: 33KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 103KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 33KB - Virtual size: 33KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 103KB

.reloc
Size: 3KB - Virtual size: 3KB