579867be156cf91fb7efa07304ac23b3

General

Target

579867be156cf91fb7efa07304ac23b3
Size

27KB
MD5

579867be156cf91fb7efa07304ac23b3
SHA1

8acfff6bc32309252c68f9772bc37456a075bf00
SHA256

7bf5c1a6597fa75030948a39b0f26c2c3879c404abd76ed3b43772927aa1da1c
SHA512

231f5b698a27ba1835d154bf905f25061d2e0ab6187ef38408d7217c5f260109e0116f1a088491749d644558b5ba1a0406c6aff1541179afbd9153ece33541fc
SSDEEP

768:aJe6oDHC3vjI9zZEZdyUgB6sIb5vEmGjOrEBBQARQkHLXy:ce6oDifc9rmGjOrEBBQAR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
579867be156cf91fb7efa07304ac23b3

Files

579867be156cf91fb7efa07304ac23b3
.dll windows:4 windows x86 arch:x86

783ee797a8586f922514ac1aabc2ec4c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

_snprintf
RtlZeroMemory
RtlUnwind
memcmp
memcpy
strlen
strstr

ws2_32

gethostname

kernel32

GetLastError
IsBadReadPtr
lstrcpynA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
lstrcmpA
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
UnmapViewOfFile
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
LoadLibraryA
MapViewOfFile
MoveFileExA
ReadFile

user32

CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
GetWindowThreadProcessId
FindWindowA
wsprintfA

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

783ee797a8586f922514ac1aabc2ec4c

Headers

File Characteristics

Imports

ntdll

ws2_32

kernel32

user32

Sections

.text Size: 20KB - Virtual size: 20KB

.bss Size: - Virtual size: 12B

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 608B

.text
Size: 20KB - Virtual size: 20KB

.bss
Size: - Virtual size: 12B

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 608B