7a15806b6ebb81a4445da2234c96ce38

Sharing

Copy URL Twitter E-mail

General

Target

7a15806b6ebb81a4445da2234c96ce38
Size

48KB
MD5

7a15806b6ebb81a4445da2234c96ce38
SHA1

52699aa5d682963436a1ebe7fe133f2023bb7631
SHA256

750933dd8d0b2dceecd3822361871cbbea79f65d1cfb2e78773fb79b82034b51
SHA512

f478bc1b6eed7d1e2e23d56f2eb1f6245bda15b23a9efb9a1905d9dc3e8706910210c1f40cbff70739cebd1c1d7740d4c0351b1fdf68eeb85918b06e40e5e1db
SSDEEP

768:dOkOe+kkNxB6awFXjjL0c0tmHnwDIffQDVD3miRxEtYFoeuI124aoSf:dOk8sJFXfLDHLfQ5D2cxEt+Xu0an

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a15806b6ebb81a4445da2234c96ce38

Files

7a15806b6ebb81a4445da2234c96ce38
.dll windows:5 windows x86 arch:x86

262679b4b3e01f4c17d32178ca2f3519

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

ZwCreateEvent
ZwClose

kernel32

RaiseException
GlobalUnlock
CreateEventA
MulDiv
CloseHandle
VirtualAlloc
GetUserDefaultLangID
SetCurrentDirectoryA
SetErrorMode
GlobalSize
VirtualQuery
PulseEvent
InterlockedDecrement
FlushInstructionCache
DosDateTimeToFileTime
GetVersion
FileTimeToLocalFileTime
WaitForSingleObject
CreateThread

clb

ClbAddData
ClbStyleW

Exports

Exports

CreateProcessNotify
audinmgr
SetTcpEntry
Icmp6SendEcho2
InternalCreateIpForwardEntry
SetIpNetEntry
FlushIpNetTable
NTTimeToNTPTime
UnenableRouter
GetIpStatistics
RestoreMediaSense
GetTcpTable
GetBestInterface
DisableMediaSense
InternalSetIpNetEntry
GetOwnerModuleFromTcp6Entry
GetInterfaceInfo
GetExtendedUdpTable
GetExtendedTcpTable
IpReleaseAddress
GetUdpStatistics
NhpAllocateAndGetInterfaceInfoFromStack
InternalSetIpStats
EnableRouter
GetRTTAndHopCount
GetNetworkParams
InternalSetIfEntry
NotifyRouteChange
IcmpSendEcho
InternalGetTcpTable
IcmpParseReplies
GetOwnerModuleFromTcpEntry
SetIpForwardEntry
SetIfEntry
InternalGetIpNetTable
GetAdapterIndex
GetBestInterfaceEx
Icmp6ParseReplies
register_icmp
IpRenewAddress
GetOwnerModuleFromUdpEntry
InternalGetUdpTable
GetNumberOfInterfaces
GetTcpStatistics
InternalDeleteIpForwardEntry
GetAdaptersAddresses
DeleteIPAddress
CreateIpNetEntry
GetBestRoute
CreateIpForwardEntry
SetIpStatistics
GetPerAdapterInfo
GetIcmpStatisticsEx
CancelIPChangeNotify
SetAdapterIpAddress
NhGetInterfaceNameFromGuid
NhGetInterfaceNameFromDeviceGuid
Icmp6CreateFile
GetUdpStatisticsEx
GetIfTable
GetTcpStatisticsEx
GetIpErrorString
InternalDeleteIpNetEntry
do_echo_req
DeleteIpForwardEntry
InternalGetIfTable
InternalSetIpForwardEntry
CreateProxyArpEntry
SendARP
GetOwnerModuleFromUdp6Entry

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

262679b4b3e01f4c17d32178ca2f3519

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

clb

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 36KB

.data Size: 9KB - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 36KB

.data
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB