79f3501e1ef83d5107c3f98dd1152e9e

Sharing

Copy URL Twitter E-mail

General

Target

79f3501e1ef83d5107c3f98dd1152e9e
Size

320KB
MD5

79f3501e1ef83d5107c3f98dd1152e9e
SHA1

575ed7e14acf02874a79e996d26d5ca6d9b11928
SHA256

2d24fecc9b5a91f892cfb4a4218f041bb8c4c148a1605c9a95f0fe8ccbd1e03c
SHA512

c61af373b663443a668a78c04771981ca8fe26eb9e8a350b17179bf0fc7b57c099657ad64dd12c20dd85f8fcddd4cdaaa13af3d83d1f3210f9e74e7e8058b74f
SSDEEP

3072:83XmPKRBFRjczGES0YESN4ggaj71nDVovadRF9dPTj4UZjSoXYEJ39stLf5lM8:u2PKRBFxEZ7cBxDGwZjZ5NSk8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79f3501e1ef83d5107c3f98dd1152e9e

Files

79f3501e1ef83d5107c3f98dd1152e9e
.dll windows:4 windows x86 arch:x86

15a3ac8c74d8045645760a4cb4a2a603

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
GetTempFileNameW
GetWindowsDirectoryW
FindClose
FindFirstFileW
CopyFileW
GetProcAddress
LoadLibraryW
CreateProcessW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetTempPathW
SetFilePointer
Sleep
GetFileAttributesW
ReadFile
GetCurrentDirectoryW
LocalFileTimeToFileTime
CreateDirectoryW
SetFileTime
CreateFileA
SetEndOfFile
GetLocaleInfoA
GetTickCount
GetModuleFileNameW
CreateFileW
WriteFile
CloseHandle
lstrcpynW
SystemTimeToFileTime
GetSystemTime
GetStringTypeW
GetStringTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
LoadLibraryA
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetModuleFileNameA
QueryPerformanceCounter

user32

GetWindowTextW
EnumWindows
GetWindow
IsWindowVisible
GetDesktopWindow
SetForegroundWindow
MessageBoxW

advapi32

RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW

shell32

ShellExecuteW

ole32

StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize

shlwapi

SHDeleteKeyW

wininet

HttpOpenRequestW
HttpAddRequestHeadersW
InternetAttemptConnect
InternetConnectW
InternetOpenW
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
HttpSendRequestW

Sections

.text
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15a3ac8c74d8045645760a4cb4a2a603

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

Sections

.text Size: 188KB - Virtual size: 184KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 188KB - Virtual size: 184KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 12KB - Virtual size: 10KB