6fbdb37a2854b6a50fe8a98b814c1b4c

Sharing

Copy URL Twitter E-mail

General

Target

6fbdb37a2854b6a50fe8a98b814c1b4c
Size

101KB
MD5

6fbdb37a2854b6a50fe8a98b814c1b4c
SHA1

866b9f7d017e359e2bd53b06e4cce911b301626d
SHA256

411b986b0a8bfb5fbe3c27a00f6fd978b4f9bf3a2fcd4a065862c20c6e381c0a
SHA512

9171be27e02116adb79fff08339c5e8e0f14b32cdd4d99968394c1a844593063d669005f6a9489b1799773cfc5d24afcd9021a8bf9a47ef20b97fe8b0a9ae954
SSDEEP

1536:xJDhWy7OP9Qx/552aTqZ5sJm9Txt8ou8JO2WI6HG4/IBGC:xJDhWy7OP9QMcJS8o0I6HG4/IBGC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fbdb37a2854b6a50fe8a98b814c1b4c

Files

6fbdb37a2854b6a50fe8a98b814c1b4c
.dll windows:4 windows x86 arch:x86

5a0a1602915b638c301d26118dc4a34c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
GetLastError
InitializeCriticalSection
LeaveCriticalSection
CloseHandle
UnmapViewOfFile
EnterCriticalSection
MapViewOfFile
CreateFileMappingA
GetStartupInfoA
GetModuleFileNameA
FlushFileBuffers
HeapAlloc
HeapFree
RtlUnwind
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

CreateDialogParamA
ShowWindow
PostMessageA
DestroyWindow
GetWindowLongA
IsWindow
SendMessageA
GetParent
RegisterWindowMessageA

Exports

Exports

Windows_run
activateAccessibleHyperlink
addAccessibilityEventNotification
addAccessibleSelectionFromContext
addJavaEventNotification
clearAccessibleSelectionFromContext
doAccessibleActions
getAccessibleActions
getAccessibleChildFromContext
getAccessibleContextAt
getAccessibleContextFromHWND
getAccessibleContextInfo
getAccessibleContextWithFocus
getAccessibleHyperlink
getAccessibleHyperlinkCount
getAccessibleHypertext
getAccessibleHypertextExt
getAccessibleHypertextLinkIndex
getAccessibleIcons
getAccessibleKeyBindings
getAccessibleParentFromContext
getAccessibleRelationSet
getAccessibleSelectionCountFromContext
getAccessibleSelectionFromContext
getAccessibleTableCellInfo
getAccessibleTableColumn
getAccessibleTableColumnDescription
getAccessibleTableColumnHeader
getAccessibleTableColumnSelectionCount
getAccessibleTableColumnSelections
getAccessibleTableIndex
getAccessibleTableInfo
getAccessibleTableRow
getAccessibleTableRowDescription
getAccessibleTableRowHeader
getAccessibleTableRowSelectionCount
getAccessibleTableRowSelections
getAccessibleTextAttributes
getAccessibleTextInfo
getAccessibleTextItems
getAccessibleTextLineBounds
getAccessibleTextRange
getAccessibleTextRect
getAccessibleTextSelectionInfo
getActiveDescendent
getCaretLocation
getCurrentAccessibleValueFromContext
getEventsWaiting
getHWNDFromAccessibleContext
getMaximumAccessibleValueFromContext
getMinimumAccessibleValueFromContext
getObjectDepth
getParentWithRole
getParentWithRoleElseRoot
getTextAttributesInRange
getTopLevelObject
getVersionInfo
getVirtualAccessibleName
getVisibleChildren
getVisibleChildrenCount
isAccessibleChildSelectedFromContext
isAccessibleTableColumnSelected
isAccessibleTableRowSelected
isJavaWindow
isSameObject
releaseJavaObject
removeAccessibilityEventNotification
removeAccessibleSelectionFromContext
removeJavaEventNotification
requestFocus
selectAllAccessibleSelectionFromContext
selectTextRange
setCaretPosition
setCaretUpdateFP
setFocusGainedFP
setFocusLostFP
setJavaShutdownFP
setMenuCanceledFP
setMenuDeselectedFP
setMenuSelectedFP
setMouseClickedFP
setMouseEnteredFP
setMouseExitedFP
setMousePressedFP
setMouseReleasedFP
setPopupMenuCanceledFP
setPopupMenuWillBecomeInvisibleFP
setPopupMenuWillBecomeVisibleFP
setPropertyActiveDescendentChangeFP
setPropertyCaretChangeFP
setPropertyChangeFP
setPropertyChildChangeFP
setPropertyDescriptionChangeFP
setPropertyNameChangeFP
setPropertySelectionChangeFP
setPropertyStateChangeFP
setPropertyTableModelChangeFP
setPropertyTextChangeFP
setPropertyValueChangeFP
setPropertyVisibleDataChangeFP
setTextContents

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a0a1602915b638c301d26118dc4a34c

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB