4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522

Sharing

Copy URL

Twitter E-mail

General

Target

4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522
Size

16KB
MD5

b2f4a69100a14c006d32da478877607c
SHA1

aa2dcfd016096eb88f9da4c8189266c3a7f32d10
SHA256

4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522
SHA512

74c18bba30fad4fda632bc2adf55d3f5a4b2a22db2987f069c7a2abe8239b7ce46d7ec4d6a89cdf834a8f2941bbc05c250ed446dcf2694a0ae51dfbfc38b534b
SSDEEP

384:b/fSN9v5X13j+Ftrv+tzzJNXooywNhPlBAuEP:b3SN9vl1qFNv+tnzjy8h+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522

Files

4982294c6987abddef014bea2095b8afad143789fb35a6ee27e6ca9570018522
.dll windows:5 windows x64 arch:x64

73b0a41dd52079dd6cc2d7796cae803b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

LdrGetProcedureAddress
RtlEqualUnicodeString
LdrGetDllHandle
DbgBreakPoint
RtlImageNtHeader
NtQueryObject
DbgPrint
NtOpenProcessToken
NtFreeVirtualMemory
NtOpenThread
RtlAllocateHeap
NtQuerySystemInformation
NtWriteFile
RtlTimeToTimeFields
NtQueryInformationProcess
NtOpenProcess
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
NtAllocateVirtualMemory
NtReadVirtualMemory
NtClose
RtlAdjustPrivilege
RtlFreeHeap
NtCreateDebugObject
NtPrivilegeCheck
NtSetInformationProcess
NtQueryInformationThread
NtCreateFile
NtTerminateProcess
LdrDisableThreadCalloutsForDll
memcpy
memset

Exports

Exports

HookDllData
HookedGetLocalTime
HookedGetSystemTime
HookedGetTickCount
HookedGetTickCount64
HookedKiUserExceptionDispatcher
HookedNativeCallInternal
HookedNtClose
HookedNtContinue
HookedNtCreateThread
HookedNtCreateThreadEx
HookedNtDuplicateObject
HookedNtGetContextThread
HookedNtQueryInformationProcess
HookedNtQueryObject
HookedNtQueryPerformanceCounter
HookedNtQuerySystemInformation
HookedNtQuerySystemTime
HookedNtResumeThread
HookedNtSetContextThread
HookedNtSetDebugFilterState
HookedNtSetInformationProcess
HookedNtSetInformationThread
HookedNtUserBlockInput
HookedNtUserBuildHwndList
HookedNtUserBuildHwndList_Eight
HookedNtUserFindWindowEx
HookedNtUserQueryWindow
HookedNtYieldExecution
HookedOutputDebugStringA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73b0a41dd52079dd6cc2d7796cae803b

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 7KB

.pdata Size: 1024B - Virtual size: 528B

.reloc Size: 512B - Virtual size: 96B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 7KB

.pdata
Size: 1024B - Virtual size: 528B

.reloc
Size: 512B - Virtual size: 96B