7191bcd651a8963dbde53c83291d76a5

Sharing

Copy URL Twitter E-mail

General

Target

7191bcd651a8963dbde53c83291d76a5
Size

26KB
MD5

7191bcd651a8963dbde53c83291d76a5
SHA1

85fb07ffb45854dd3f21458824a0931d4baa48c6
SHA256

21ebff6a1bddb74774dc82f32fc67e77fd6c547da0de24d19b40a9c87634a20f
SHA512

66d79318314695fff96f9aee5ecbf62657b12843aaf4b04867adb24f6bf0cf55e4395e71d15af92747496dd3bb243d49543073d8e225f6ebfe7f47f96c948b6a
SSDEEP

768:bhO7vOo6Y2MmPmHvnDGilkCeOhNugrej40KXhvsTZg:NUOojvDpyrOKgKgXhsTZg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7191bcd651a8963dbde53c83291d76a5

Files

7191bcd651a8963dbde53c83291d76a5
.dll windows:4 windows x86 arch:x86

4f0cc4622024dc5f43d9423f98d3f11e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
IsBadReadPtr
CreateThread
WriteProcessMemory
GetPrivateProfileStringA
TerminateThread
GetPrivateProfileIntA
InitializeCriticalSection
VirtualProtectEx
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetModuleHandleA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
ReadProcessMemory
CloseHandle
GlobalAlloc
Process32First
CreateToolhelp32Snapshot
GetSystemDirectoryA
VirtualAlloc
WritePrivateProfileStringA
GetLastError
CreateMutexA
ExitProcess
WaitForSingleObject
ResetEvent
SetEvent
CreateEventA
DeleteFileA
GetModuleFileNameA
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
ResumeThread
OpenProcess
CreateProcessA
GetCurrentThread
GlobalLock
GlobalUnlock
Process32Next
GlobalFree

user32

GetWindowTextA
GetWindowThreadProcessId
GetDesktopWindow
SendMessageA
GetWindow
GetForegroundWindow
FindWindowA
GetMessageA
CallNextHookEx
SetWindowsHookExA
GetClassNameA
TranslateMessage
DispatchMessageA
FindWindowExA
UnhookWindowsHookEx

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey

shlwapi

PathFileExistsA

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

imagehlp

ImageLoad
ImageUnload

msvcrt

_strlwr
_adjust_fdiv
malloc
_initterm
free
??3@YAXPAX@Z
strncpy
sscanf
strrchr
fread
strcat
??2@YAPAXI@Z
_stricmp
memset
strstr
wcslen
strcmp
memcpy
sprintf
strlen
strcpy
fopen
fclose

Exports

Exports

Init

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdt
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f0cc4622024dc5f43d9423f98d3f11e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

wininet

imagehlp

msvcrt

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 4KB

.sdt Size: 512B - Virtual size: 424B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 4KB

.sdt
Size: 512B - Virtual size: 424B

.reloc
Size: 2KB - Virtual size: 2KB