67246227d68d05c1ede8bcb8e63db905

Sharing

Copy URL

Twitter E-mail

General

Target

67246227d68d05c1ede8bcb8e63db905
Size

19KB
MD5

67246227d68d05c1ede8bcb8e63db905
SHA1

50b16d7181583cfcb7a8ecb1579c9c3560f9c63c
SHA256

ffc4ec940d3f372d7c63c7e959c6cd4eb197eb9c965b59daef10716c19821496
SHA512

bf2dfcbae8e56d13453cf1810fc9b618c7f6e74d75569c26d3241887c28006c21a31688f239ba5b07c2c07f22854fdfc9e772d07d9df5113d50d92f7253a53c1
SSDEEP

384:0mk4zi9MYLm3pwZe7ybDUsokbexzxy6XrCWRW1s:03uYLmpw3Zotx06G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67246227d68d05c1ede8bcb8e63db905

Files

67246227d68d05c1ede8bcb8e63db905
.dll windows:4 windows x86 arch:x86

d2e39263b7967b24204a2b13b5dc26ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

_vsnprintf
ZwWriteFile
ZwCreateNamedPipeFile
ZwFsControlFile
ZwDeleteKey
ZwClose
RtlInitUnicodeString
ZwOpenKey
ZwQueryValueKey
RtlImageNtHeader
RtlImageDirectoryEntryToData
RtlPrefixUnicodeString
ZwFlushInstructionCache
_strnicmp
_memicmp
_snwprintf
strchr
sscanf
RtlAdjustPrivilege
RtlRandom
ZwQueryInformationThread
RtlCreateRegistryKey
ZwCreateMutant
RtlWriteRegistryValue
_snprintf
strncpy
ZwReadFile
memset
memcpy

wininet

InternetCrackUrlA
InternetOpenA
InternetGetLastResponseInfoA
InternetReadFile
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA
InternetConnectA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shlwapi

PathRemoveExtensionA
PathFindFileNameA
PathFindFileNameW
SHRegSetUSValueW
StrStrIA

kernel32

UnlockFile
LockFile
IsBadCodePtr
IsBadReadPtr
GetCurrentProcess
GetExitCodeThread
WaitForSingleObject
GetLastError
LocalFree
LoadLibraryA
OutputDebugStringA
VirtualFree
OpenProcess
CloseHandle
TerminateThread
DeleteFileA
SleepEx
Sleep
CreateThread
VirtualAlloc
GetCurrentThread
ExitThread
GetTickCount
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
HeapFree
BindIoCompletionCallback
CreateFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
GetTempPathA
GetFileAttributesA
MoveFileExA
GetModuleFileNameW

user32

OpenWindowStationA
GetWindowThreadProcessId
GetForegroundWindow
GetGUIThreadInfo
SetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
CloseDesktop
CloseWindowStation

advapi32

LsaQueryInformationPolicy
DuplicateToken
LsaClose
LsaFreeMemory
ConvertSidToStringSidA
OpenProcessToken
LsaOpenPolicy
ImpersonateLoggedOnUser
SetThreadToken

imagehlp

MapFileAndCheckSumA

psapi

GetMappedFileNameA

Exports

Exports

CheckValue
CmdExec
CmdExecAffID
CmdExecBotID
CmdExecBuild
CmdExecSubID
CmdExecType
CmdExecVersion
CryptKeySet
FileDownload
FileDownloadRandom
FileDownloadRandomUnxor
FileDownloadUnxor
ImpersonateAsInput
Knock
ModuleDownload
ModuleDownloadUnxor
ModuleLoad
ModuleUnload
ModulesVersionLog
SetCmdDelay
SetInputDesktop
SetLoadedURL
SetTimeout

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2e39263b7967b24204a2b13b5dc26ce

Headers

File Characteristics

Imports

ntdll

wininet

version

shlwapi

kernel32

user32

advapi32

imagehlp

psapi

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 428B

.rsrc Size: 1024B - Virtual size: 744B

.reloc Size: 1024B - Virtual size: 924B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 428B

.rsrc
Size: 1024B - Virtual size: 744B

.reloc
Size: 1024B - Virtual size: 924B