773726e7089ae2ac2465aa6763a1c2bb

Sharing

Copy URL

Twitter E-mail

General

Target

773726e7089ae2ac2465aa6763a1c2bb
Size

108KB
MD5

773726e7089ae2ac2465aa6763a1c2bb
SHA1

39dcf8aed2f703fb5c8260ffceb7baf9a7b87bd2
SHA256

49675b0da0ce1faaffe38e1ecb924eb277570e0c196ec29d9f6a65394c27b8d7
SHA512

e47b93eb6db22370c2b488da2381937e9294f8e74e7fe2e48a722a2c8be85a8dd652b92a5fd4a7081952fdd01a649d7d579f0dc33e5f60cbf15334395345b3d0
SSDEEP

3072:l/Z36g1b/rJreeOXr4pTpZmAO8QlDqB8N:vz/rJretXrKTpZmcGqB8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
773726e7089ae2ac2465aa6763a1c2bb

Files

773726e7089ae2ac2465aa6763a1c2bb
.dll windows:4 windows x86 arch:x86

703a4bd91ade4af0c18c531ed7a48ac3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
LocalFree
FormatMessageA
GetCurrentProcessId
GetLastError
VirtualFreeEx
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
OutputDebugStringA
SetLastError
Sleep
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
GetShortPathNameA
LeaveCriticalSection
TerminateProcess
WriteFile
ReadFile
PeekNamedPipe
GetSystemDirectoryA
CreatePipe
GlobalMemoryStatus
GetVersionExA
DeleteFileA
GetLongPathNameA
GetTempPathA
GetLocalTime
GetTickCount
HeapAlloc
GetProcessHeap
CreateThread
GetEnvironmentVariableA
lstrcpyA
lstrcatA
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ResumeThread
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetCurrentProcess
CloseHandle
EnterCriticalSection
WaitForSingleObject
SetEndOfFile
GetSystemInfo
VirtualProtect
IsBadCodePtr
IsBadReadPtr
SetFilePointer
CreateFileA
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCPInfo
GetOEMCP
GetACP
GetEnvironmentStringsW
ExitThread
GetCurrentThreadId
ExitProcess
RtlUnwind
RaiseException
HeapFree
HeapReAlloc
GetCommandLineA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
InterlockedExchange
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

advapi32

OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyA
SetServiceStatus
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA

ws2_32

gethostbyname
inet_ntoa
sendto
htonl
WSASocketA
listen
accept
WSAGetLastError
connect
setsockopt
send
WSAStartup
socket
inet_addr
htons
bind
WSAIoctl
closesocket
recv
WSACleanup
gethostname
select

urlmon

URLDownloadToFileA

wininet

InternetGetConnectedStateEx
GetUrlCacheEntryInfoA

Exports

Exports

ServiceMain
install
uninstall

Sections

.text
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

703a4bd91ade4af0c18c531ed7a48ac3

Headers

File Characteristics

Imports

kernel32

advapi32

ws2_32

urlmon

wininet

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 65KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 8KB - Virtual size: 15KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 68KB - Virtual size: 65KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 15KB

.reloc
Size: 8KB - Virtual size: 6KB