72e92edf7bf193cb20d5f14079fdc4d9

Sharing

Copy URL

Twitter E-mail

General

Target

72e92edf7bf193cb20d5f14079fdc4d9
Size

362KB
MD5

72e92edf7bf193cb20d5f14079fdc4d9
SHA1

5f3db6e6ed910a8f0d1e526d0636ec774dd53d69
SHA256

7ad8fdb33454ab54155e2ad663c4467b67a52dd49975419e02b8e128a4ef2747
SHA512

b99059322c0b76e651ac58715ab7736228f81a0f8d0ae1a21efcdfa59ea6a5274e24d2dca96bec95d36811914b0592796d14c5e026938c1b8c852752279f01a0
SSDEEP

6144:sX1qQRVmfcLYgIawIK4RtAgW/YxbzoH/Evf0DjQifvBgwMlgjS7XYN+LWQW1Hm5f:I1hRIfkYgu14RwmzoLDjTfvuxlgjMX6y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72e92edf7bf193cb20d5f14079fdc4d9

Files

72e92edf7bf193cb20d5f14079fdc4d9
.dll windows:6 windows x86 arch:x86

9ddf968da1d6b2349bc21e446782d57a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
FlushInstructionCache
IsWow64Process
HeapFree
HeapValidate
HeapSize
HeapAlloc
GetProcessHeap
lstrcmpiA
HeapReAlloc
VirtualQuery
GetLastError
ReadProcessMemory
GetFileSizeEx
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
OpenProcess
LoadLibraryA
GetProcAddress
WideCharToMultiByte
CreateNamedPipeA
SetLastError
FileTimeToSystemTime
CreateToolhelp32Snapshot
GlobalAlloc
GlobalFree
WTSGetActiveConsoleSessionId
GetNativeSystemInfo
CreateProcessA
GetExitCodeThread
CreateThread
InterlockedIncrement
GetVersionExA
DecodePointer
SetFilePointerEx
GetConsoleMode
VirtualProtectEx
GetModuleHandleA
SetFilePointer
VirtualAlloc
WriteFile
GetCurrentProcess
VirtualFree
WriteProcessMemory
ReadFile
DeleteCriticalSection
Sleep
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateFileA
FindNextFileA
FreeLibrary
GetConsoleCP
FlushFileBuffers
SetStdHandle
CreateFileW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
FindClose
LCMapStringW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
TerminateProcess
RaiseException
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
GetStdHandle
GetFileType
WriteConsoleW
GetACP

user32

wsprintfA

advapi32

RevertToSelf
CreateProcessAsUserA
DuplicateTokenEx
RegDisablePredefinedCacheEx
GetUserNameA
ImpersonateLoggedOnUser
DuplicateToken
ConvertSidToStringSidW
GetTokenInformation
CryptDestroyKey
CryptGenRandom
CryptDestroyHash
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenProcessToken
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

userenv

CreateEnvironmentBlock

shlwapi

StrStrIA
StrCmpNIA
StrCmpNA
wnsprintfA

wtsapi32

WTSQueryUserToken

ws2_32

setsockopt
connect
htons
gethostbyname
WSAGetLastError
socket
shutdown
closesocket
bind
accept
recv
send
WSAStartup
htonl

Exports

Exports

?AFind@@YAHPAX@Z
?AIAnAiAt@@YAXH@Z
?MegaFreeBuffer@@YAXPAX@Z
?ReleaseModuleBuffers@@YAXPAX@Z
?ShAuAtadAoAwan@@YAXXZ
?ShutdownPrimary@@YAXXZ
?SuperControl@@YAHPAX@Z
?SuperControlTimer@@YAHPAX@Z
Control
FreeBuffer
ProcessStart
Release
Start
StartSubProcess

Sections

.text
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ddf968da1d6b2349bc21e446782d57a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

userenv

shlwapi

wtsapi32

ws2_32

Exports

Exports

Sections

.text Size: 310KB - Virtual size: 310KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 310KB - Virtual size: 310KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB