7b83d00d1681d81371dd496638f7ceaf

Sharing

Copy URL Twitter E-mail

General

Target

7b83d00d1681d81371dd496638f7ceaf
Size

80KB
MD5

7b83d00d1681d81371dd496638f7ceaf
SHA1

c5ac7f57f7461bbcc380f224ce3d444004563d56
SHA256

ddc07ced1a94be9d3bd059457e9e3077e92e12f52ea610db9cbe21f542b0005f
SHA512

368353af79b65eb5f460e9d12a2c938fbd582a6578dd787222612036f02c6d1c6cd18471021dd183eba77558e9f4ceeeb9a103d5b828852190c8c186a88130fe
SSDEEP

1536:WDrySVvlKeuJZfFewDcVidzuWmHRtp7WVSIaqbR4j7P/:7S1lKeurf8wDcVMzuJHRtp7W8fo4j7P/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b83d00d1681d81371dd496638f7ceaf

Files

7b83d00d1681d81371dd496638f7ceaf
.dll windows:4 windows x86 arch:x86

88a7ce8157350cc519b96eb0ae6039d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

WSAStartup
gethostname
socket
htons
connect
setsockopt
closesocket
WSAGetLastError
ioctlsocket
gethostbyname
send
inet_addr
gethostbyaddr
recv

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

kernel32

FindClose
FindNextFileA
GetFileAttributesExA
FindFirstFileA
ReadFile
OpenFileMappingA
GetFileSize
CreateFileA
CreateDirectoryA
GetModuleFileNameA
WriteFile
DeleteFileA
CreateProcessA
GetStartupInfoA
Sleep
MoveFileExA
CloseHandle
HeapAlloc
GetProcessHeap
CreateThread
TerminateProcess
GetCurrentThreadId
MapViewOfFile
ResetEvent
CreateEventA
VirtualFree
VirtualAlloc
ExitThread
GetModuleHandleA
UnmapViewOfFile
GlobalFree
GlobalAlloc
GetDriveTypeA
GetSystemDirectoryA
HeapFree
CreateFileMappingA
SetFilePointer
SetEvent

user32

SetWindowsHookExA
GetAsyncKeyState
GetKeyNameTextA
MapVirtualKeyA
GetKeyState
PeekMessageA
PostThreadMessageA
IsWindow
GetWindowTextA
GetWindowRect
GetDC
ReleaseDC
CallNextHookEx
MessageBoxA
GetActiveWindow
GetForegroundWindow

gdi32

RealizePalette
SelectPalette
GetStockObject
GetDIBits
GetObjectA
GetDeviceCaps
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteDC
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
RegQueryValueExA
DeleteService
OpenServiceA
CloseServiceHandle

msvcrt

fclose
longjmp
_setjmp3
sprintf
fopen
_ftol
fseek
fprintf
strncpy
strncat
_stat
strchr
getenv
strrchr
_splitpath
strspn
malloc
free
_initterm
_adjust_fdiv
wcslen
fwrite
sscanf
_strcmpi
_strnicmp
??2@YAPAXI@Z
__CxxFrameHandler

lz32

LZOpenFileA

shlwapi

PathFileExistsA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mydata
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88a7ce8157350cc519b96eb0ae6039d8

Headers

File Characteristics

Imports

wsock32

imm32

kernel32

user32

gdi32

advapi32

msvcrt

lz32

shlwapi

iphlpapi

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 8KB - Virtual size: 7KB

mydata Size: 4KB - Virtual size: 16B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 7KB

mydata
Size: 4KB - Virtual size: 16B

.reloc
Size: 4KB - Virtual size: 2KB