7ed0b1a6b99b7ed51f38486535237467

Sharing

Copy URL Twitter E-mail

General

Target

7ed0b1a6b99b7ed51f38486535237467
Size

72KB
MD5

7ed0b1a6b99b7ed51f38486535237467
SHA1

d318f6ecc01fc419538a4bdba1414030d89f8e92
SHA256

2485961ff79d940a8cdb1b0d6c6c1e5a4e60d0842a080ed9c3cc32b0e440495f
SHA512

541ee29a4121947068db767fca7e5d1fd562518ccf6b10661e104b8021ae4d7b0aff92557a584251ccf5eb76a8289b8422f06249c5da896bba8fd00ea3585f47
SSDEEP

1536:Af/tmm1QUyiG3uTeOt49BPo8gyrBUsoroyB8:Aom1QUyZrBPjBDoroyB8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ed0b1a6b99b7ed51f38486535237467

Files

7ed0b1a6b99b7ed51f38486535237467
.dll windows:4 windows x86 arch:x86

6d3489c714bab81a35a8b7dab8179600

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
WriteFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
CreateEventA
SetEvent
FreeConsole
SetUnhandledExceptionFilter
GetWindowsDirectoryA
GetCurrentProcessId
CreateFileA
SetFilePointer
ReadFile
GetSystemDirectoryA
GetTickCount
GetModuleHandleA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
OpenProcess
lstrlenA
Sleep
DeleteFileA
SetLastError
GetLastError
WaitForSingleObject
CloseHandle
lstrcatA
GetProcessHeap
HeapAlloc
SetEndOfFile
HeapFree
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetCPInfo
IsBadCodePtr
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TlsAlloc
TlsFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr

user32

wsprintfA
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
SetThreadDesktop

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey

wininet

InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
DeleteUrlCacheEntry

urlmon

URLDownloadToFileA

Exports

Exports

ServiceMain

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d3489c714bab81a35a8b7dab8179600

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

urlmon

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 25KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 25KB

.reloc
Size: 8KB - Virtual size: 4KB