7d59fe16dfb7f38d8631a772a2a7cf44

Sharing

Copy URL Twitter E-mail

General

Target

7d59fe16dfb7f38d8631a772a2a7cf44
Size

108KB
MD5

7d59fe16dfb7f38d8631a772a2a7cf44
SHA1

af642066a67674f6bebb0d9e5e3d40436164dabc
SHA256

283693f96179b3e3d881665892a44100909e389c12fc4acb47e731bbce099eca
SHA512

424374eb97d1caf3ac1d7880403ffb72f3cc42f3327a42db59c0a96f528f60d087ffa020722078c0c0093fd390a85e911c3b65db82acbc562c88eadb7ca172a0
SSDEEP

1536:0bsI1HOVXt2EECYQDxzzxFmafu/fZknm/6ob8HQMVFI:0bbwtlzxFX2jfb8HQM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d59fe16dfb7f38d8631a772a2a7cf44

Files

7d59fe16dfb7f38d8631a772a2a7cf44
.dll windows:4 windows x86 arch:x86

aa3f860b80f616c2a3548d88fbc79851

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project2\update\dll_service\NZellDol\release\clifersub.pdb

Imports

wininet

InternetReadFile
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetQueryDataAvailable

netapi32

Netbios

urlmon

URLDownloadToFileA

kernel32

RtlUnwind
InitializeCriticalSection
GetConsoleOutputCP
WriteConsoleA
lstrlenA
LoadResource
LockResource
Sleep
SizeofResource
FindResourceA
FindResourceExA
GetLastError
GetProcAddress
WriteConsoleW
InterlockedExchange
LoadLibraryA
FreeLibrary
CompareStringW
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetLocaleInfoA
SetEnvironmentVariableA
CreateFileA
CloseHandle
FlushFileBuffers
GetThreadLocale
CompareStringA
GetCommandLineA
GetStringTypeW
GetStringTypeA
SetStdHandle
RaiseException
GetTimeZoneInformation
GetLocalTime
HeapFree
HeapReAlloc
HeapAlloc
VirtualAlloc
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetConsoleMode
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetConsoleCP

user32

UnregisterClassA

advapi32

RegisterServiceCtrlHandlerExA
RegSetValueExA
StartServiceCtrlDispatcherA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
SetServiceStatus

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Exports

Exports

ServiceMain
_HandlerEx@16

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa3f860b80f616c2a3548d88fbc79851

Headers

File Characteristics

PDB Paths

Imports

wininet

netapi32

urlmon

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 64KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 68KB - Virtual size: 64KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 6KB