63a0c1dea8d08232dd6d801b91481f4c

Sharing

Copy URL Twitter E-mail

General

Target

63a0c1dea8d08232dd6d801b91481f4c
Size

5.8MB
MD5

63a0c1dea8d08232dd6d801b91481f4c
SHA1

c2d23920a1d933ff408d097f2f8573d0feeb31f6
SHA256

9dfe9ee05e73daad5fc741a9c005cccb8c911e8e264b8032177726490484efef
SHA512

95d54159fa05f359af59c870d341693f0f90ec59d70ed3b222fdf6ddc6cd1bc254aaaa66f222d7e68b28aeebb1f659ad3bef81d18f6e91f0d38ea007236a04bf
SSDEEP

98304:xoGbWbPEJr1sCm/WZrzIfo2pSM+7gdBFuQDzynwsE9npeY97++5:xPKbPUc/QrzIA2pKgdCez7UYM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63a0c1dea8d08232dd6d801b91481f4c

Files

63a0c1dea8d08232dd6d801b91481f4c
.dll windows:5 windows x86 arch:x86

eac588c68a744e9c0dc4b7b2ea66ac5a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

winmm

PlaySoundW

wininet

FindFirstUrlCacheEntryW

winspool.drv

DocumentPropertiesW

comctl32

ImageList_GetImageInfo

shell32

SHGetSpecialFolderLocation

user32

DdeSetUserHandle
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

version

GetFileVersionInfoSizeW

oleaut32

GetErrorInfo

advapi32

RegSetValueExW

netapi32

NetWkstaGetInfo

msvcrt

memcpy

winhttp

WinHttpGetIEProxyConfigForCurrentUser

kernel32

GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

shfolder

SHGetFolderPathW

wsock32

gethostbyaddr

ole32

OleRegEnumVerbs

gdi32

Pie

ntdll

RtlCompressBuffer

wtsapi32

WTSSendMessageW

Exports

Exports

QJtrzdVtbdYnm86d
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

8p9S5A*
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Ft?g;!>O
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DB_sIp '
Size: - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

"Vp=u?SW
Size: - Virtual size: 36KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

D (6g.]p
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RU6>?>*Y
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

@Z/"^c"g
Size: - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

A\caQ0
Size: - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

P*^O:sO-
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

2@BSvQ:M
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

2^FP?[6r
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

o87tQ$
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eac588c68a744e9c0dc4b7b2ea66ac5a

Headers

File Characteristics

Imports

winmm

wininet

winspool.drv

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

winhttp

kernel32

shfolder

wsock32

ole32

gdi32

ntdll

wtsapi32

Exports

Exports

Sections

8p9S5A* Size: - Virtual size: 4.5MB

Ft?g;!>O Size: - Virtual size: 10KB

DB_sIp ' Size: - Virtual size: 78KB

"Vp=u?SW Size: - Virtual size: 36KB

D (6g.]p Size: - Virtual size: 17KB

RU6>?>*Y Size: - Virtual size: 3KB

@Z/"^c"g Size: - Virtual size: 186B

A\caQ0 Size: - Virtual size: 69B

P*^O:sO- Size: - Virtual size: 2.6MB

2@BSvQ:M Size: 5.8MB - Virtual size: 5.8MB

2^FP?[6r Size: 1KB - Virtual size: 1KB

o87tQ$ Size: 1024B - Virtual size: 624B

8p9S5A*
Size: - Virtual size: 4.5MB

Ft?g;!>O
Size: - Virtual size: 10KB

DB_sIp '
Size: - Virtual size: 78KB

"Vp=u?SW
Size: - Virtual size: 36KB

D (6g.]p
Size: - Virtual size: 17KB

RU6>?>*Y
Size: - Virtual size: 3KB

@Z/"^c"g
Size: - Virtual size: 186B

A\caQ0
Size: - Virtual size: 69B

P*^O:sO-
Size: - Virtual size: 2.6MB

2@BSvQ:M
Size: 5.8MB - Virtual size: 5.8MB

2^FP?[6r
Size: 1KB - Virtual size: 1KB

o87tQ$
Size: 1024B - Virtual size: 624B