646132ebf3cdc6fe9e09cf6d146459e9

Sharing

Copy URL Twitter E-mail

General

Target

646132ebf3cdc6fe9e09cf6d146459e9
Size

24KB
MD5

646132ebf3cdc6fe9e09cf6d146459e9
SHA1

c702edd05f101a9f953c27279cdc5e77a9e7a5d6
SHA256

9e21cbd0e75bfea1340316e9b376ce141f91667534bec7a27d9f0067ee2d7d93
SHA512

d187e3fb7850a7a5588bb289df239ef84ced6360cabb421c76db14c9d27588d128423c2b9d553c07c1a39f22dd486388365400b300d888510182714b9901f914
SSDEEP

384:C3xfdu2lctMCd64F2kdmeslqosF3SHyU7J6FSgpFDcZW1xql/lilwEm5tz8w4L1u:ifdlitV64F2kdmeslqosF3SSlIgpMW1k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
646132ebf3cdc6fe9e09cf6d146459e9

Files

646132ebf3cdc6fe9e09cf6d146459e9
.dll windows:5 windows x86 arch:x86

dd2b6e111b8b99c3e24b2189354d3d48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

StartServiceW
CloseServiceHandle
RegisterEventSourceW
RegisterServiceCtrlHandlerExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
DeregisterEventSource
QueryServiceStatus
SetServiceStatus
ReportEventW
RegCloseKey
OpenSCManagerW
OpenServiceW

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetComputerNameExW
CloseHandle
CreateFileW
SetErrorMode
VerifyVersionInfoW
SetLastError
SetEvent
UnregisterWait
Sleep
RegisterWaitForSingleObject
CreateEventW
OutputDebugStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

msvcrt

free
malloc
??2@YAPAXI@Z
_initterm
wcscmp
??3@YAXPAX@Z
_adjust_fdiv
vsprintf
wcscpy
_except_handler3
wcslen

ntdll

NtClose
NtDeviceIoControlFile
NtOpenFile
RtlInitUnicodeString
DbgPrintEx
NtOpenEvent
VerSetConditionMask

ntdsapi

DsMakeSpnW

rpcrt4

I_RpcExceptionFilter
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoW
NdrClientCall2
RpcStringFreeW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

user32

UnregisterDeviceNotification
RegisterDeviceNotificationW
wsprintfW

Exports

Exports

ServiceMain

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd2b6e111b8b99c3e24b2189354d3d48

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

ntdsapi

rpcrt4

setupapi

user32

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 884B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 932B

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 884B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 932B