7a382b27df4eebcc29a30d7e3030cd40

Sharing

Copy URL Twitter E-mail

General

Target

7a382b27df4eebcc29a30d7e3030cd40
Size

304KB
MD5

7a382b27df4eebcc29a30d7e3030cd40
SHA1

f160e0211db6a3da25bff34f7794824217ca8f49
SHA256

bb7f0ffeec9994377f8cc9d7fdc630ae06641e298f4f67193499378759db23be
SHA512

7da416f9084a410624d3eb0eff754cefac092380b4318a71b9b745d3728be013db7376d671507047196ed5972547a3a289555f6baf21f73b4e3a596b44bda77e
SSDEEP

6144:G/0V06Qp/oIi/HA5rTqj2vX2ndkmrEcwXQM1dQ5QyC/Nv4:GZ6QZH7LgMNygv4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a382b27df4eebcc29a30d7e3030cd40

Files

7a382b27df4eebcc29a30d7e3030cd40
.dll windows:4 windows x86 arch:x86

3624b0c9b7737655c50cb0934a0ca5f6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHFileOperationA
SHChangeNotify
SHCreateProcessAsUserW

rpcrt4

UuidCreate

ole32

CoTaskMemFree
CoTaskMemAlloc

dbghelp

GetTimestampForLoadedLibrary
ImagehlpApiVersion
FindExecutableImageEx
FindExecutableImage
ImageRvaToSection
ImageNtHeader

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CloseDesktop
CloseClipboard
CloseWindow
CharNextA
CloseWindowStation
GetDC
GetKeyboardLayout
GetKeyboardLayoutList
GetMenuCheckMarkDimensions
GetMonitorInfoA
GetSysColor
GetSystemMetrics
ReleaseDC
CharPrevA

kernel32

DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessTimes
GetShortPathNameA
GetStringTypeExW
DeleteCriticalSection
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalMemoryStatus
HeapAlloc
HeapCreate
CreateSemaphoreA
HeapFree
HeapLock
HeapReAlloc
HeapSize
HeapUnlock
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
SetFileAttributesW
SetLastError
SetLocalTime
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteFile
CreateMutexA
CreateFileW
CreateDirectoryW
HeapDestroy
CloseHandle
GetSystemDefaultLCID

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
ConvertSidToStringSidA
CheckTokenMembership
AllocateAndInitializeSid
AddAccessDeniedAce
AddAccessAllowedAce
GetLengthSid
UnregisterTraceGuids
TraceEvent
SetSecurityDescriptorDacl
RegisterTraceGuidsA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetTraceLoggerHandle
GetTraceEnableLevel
GetTokenInformation
GetSecurityDescriptorDacl
CopySid

shlwapi

StrChrA
PathFileExistsA
StrCmpNA
ChrCmpIA

gdi32

DeleteObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
CreateDCA

dsound

ord9

Exports

Exports

CloseFeed
GetPort
IsReadyToRead
OpenFeed
ReadData
RunScript
SendData
WSAStart

Sections

.text
Size: 234KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3624b0c9b7737655c50cb0934a0ca5f6

Headers

File Characteristics

Imports

shell32

rpcrt4

ole32

dbghelp

version

user32

kernel32

advapi32

shlwapi

gdi32

dsound

Exports

Exports

Sections

.text Size: 234KB - Virtual size: 235KB

.rdata Size: 39KB - Virtual size: 40KB

.data Size: 15KB - Virtual size: 16KB

.idata Size: 5KB - Virtual size: 8KB

.rsrc Size: 6KB - Virtual size: 8KB

.text
Size: 234KB - Virtual size: 235KB

.rdata
Size: 39KB - Virtual size: 40KB

.data
Size: 15KB - Virtual size: 16KB

.idata
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 6KB - Virtual size: 8KB