6382e08d4585573b9001a04171e29ee0

Sharing

Copy URL Twitter E-mail

General

Target

6382e08d4585573b9001a04171e29ee0
Size

144KB
MD5

6382e08d4585573b9001a04171e29ee0
SHA1

c9575bc972b37d088407fc6deecf5d729613f3d5
SHA256

2ea9cb52f10d7bd95eb33d2442b3ed46cf025af1910beaac2f9ce8f566f9fe6f
SHA512

d3bda8059653ab3efb934348c5062b6e71a562df563c7fd447b2dd7a53fa1fd1061e488b8813b7f641441bc3b41c3d11b19e44ea199dada9ab8be7895dc3fbe9
SSDEEP

3072:dezffH5ABMKM5LeQiXP4ojsQySGXDJHOTH4jlBP704q6GJgf4+FvlQ:Qz5ABM/9eQiXP4ojsQySGzJHOsjlN04d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6382e08d4585573b9001a04171e29ee0

Files

6382e08d4585573b9001a04171e29ee0
.dll windows:4 windows x86 arch:x86

c8d881ec5d58933faaf62a8c7745233b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadWritePtr
MoveFileExA
GetExitCodeThread
CreateThread
GetCurrentThreadId
SystemTimeToFileTime
GetSystemTime
GetModuleFileNameA
DeleteFileA
CreateFileA
GetWindowsDirectoryA
OpenProcess
GetCurrentProcessId
GetProcessTimes
GetLocaleInfoA
EnterCriticalSection
GetVersionExA
GetCurrentProcess
HeapReAlloc
GetOverlappedResult
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
Sleep
CloseHandle
GetLastError
FreeLibrary
ResetEvent
SetEvent
CreateEventA
IsBadReadPtr
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
HeapFree
GetProcessHeap
HeapAlloc
CreateMutexA
QueryDosDeviceA
DefineDosDeviceA
DeviceIoControl
GetVolumeInformationA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetCommandLineA
QueryPerformanceCounter
GetTickCount
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
TerminateProcess
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile

user32

wsprintfA

advapi32

GetLengthSid
RegEnumKeyExA
RegDeleteValueA
InitializeSecurityDescriptor
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AllocateAndInitializeSid
AddAce
IsValidSecurityDescriptor
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

dnsapi

DnsRecordListFree
DnsQuery_A

ws2_32

htons
closesocket
gethostname
WSAStartup
WSASend
WSARecv
WSACreateEvent
WSAEventSelect
WSASocketA
WSAConnect
WSAEnumNetworkEvents
WSACloseEvent
WSAGetOverlappedResult
WSAGetLastError
shutdown
setsockopt

iphlpapi

GetIpAddrTable

psapi

GetProcessMemoryInfo

Exports

Exports

mlmain

Sections

.text
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8d881ec5d58933faaf62a8c7745233b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

dnsapi

ws2_32

iphlpapi

psapi

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 104KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 10KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 108KB - Virtual size: 104KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 10KB

.reloc
Size: 12KB - Virtual size: 8KB