7938ed1405b1547a2e6984ab80e32b73

Sharing

Copy URL Twitter E-mail

General

Target

7938ed1405b1547a2e6984ab80e32b73
Size

13KB
MD5

7938ed1405b1547a2e6984ab80e32b73
SHA1

648dcdd4dad0bb604c721c6e1085d6d55240bd66
SHA256

03405b18e8d3d74134577d5e257a4e02cae8bbb24493bba9284438d751158fa4
SHA512

f6d41a82ed0fea32144e30655931d02547d46e9db2fe19ca14429d70d7ea733d0ee46e0c51b8963a14b2bba477ba954375507dff2b54c454f1666a2793a11632
SSDEEP

192:hYCOHNIJ9bkskYOYIC5ulVy/kjkpI6l2rbGt0+bNgk+n2tP:hncNIJ9bkrYim4y/0kpVmatj5gXn2tP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7938ed1405b1547a2e6984ab80e32b73

Files

7938ed1405b1547a2e6984ab80e32b73
.dll windows:4 windows x86 arch:x86

c8968fb5a2db90ca9d4516b6a7f8186e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
Process32Next
Sleep
Process32First
lstrcatA
lstrcpyA
lstrlenA
WriteProcessMemory
VirtualProtectEx
GetCurrentProcessId
TerminateProcess
LoadLibraryA
GetSystemDirectoryA
ExitProcess
GetProcAddress
CreateMutexA
TlsFree
TlsAlloc
DisableThreadLibraryCalls
VirtualFree
ReadFile
VirtualAlloc
GetFileSize
CreateFileA
FreeLibrary
GlobalFree
LoadLibraryExA
GlobalAlloc
WriteFile
CreateRemoteThread
WaitForSingleObject
CreateToolhelp32Snapshot
Module32First
lstrcmpiA
Module32Next
GetCurrentProcess
GetLastError
CreateThread
CloseHandle

user32

DispatchMessageA
GetMessageA
wsprintfA
TranslateMessage

advapi32

RegEnumValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA

msvcrt

free
_adjust_fdiv
malloc
_initterm
_except_handler3
_strcmpi

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumPageFilesA
EnumPageFilesW
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetPerformanceInfo
GetProcessImageFileNameA
GetProcessImageFileNameW
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
MyEntryPoint
QueryWorkingSet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 598B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8968fb5a2db90ca9d4516b6a7f8186e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 598B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 598B