85ae1a48d896b2c6448330ab27790968

General

Target

85ae1a48d896b2c6448330ab27790968
Size

18KB
MD5

85ae1a48d896b2c6448330ab27790968
SHA1

0c4fc3d09bfdf6f95f7986a2bdfbb3a14c7c8a5b
SHA256

3dfdaf40af9f228f8e849c8d9cf9aa344cef9fe0c36485bb8ad03f5a79a7c428
SHA512

54bbd402a8461c9c5cf8123ae4ac6a9aca6725cc3708ddb2c767495d2d3de529920aab5f43b10b248a7ebeacd7b68e4e0adb7b2eb757844dcf16c991fdc2956f
SSDEEP

384:UYi1/yDMPP7en3iatkmTJOpsj3U1P0G1+L:U74Mn23dtkmJssGIL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85ae1a48d896b2c6448330ab27790968

Files

85ae1a48d896b2c6448330ab27790968
.dll windows:4 windows x86 arch:x86

71d0ed43e6e0cabf5ee96f724462db81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\DownLoads\down-1114\rubbish\dnloaerc\Release\dnloaderc.pdb

Imports

kernel32

GetWindowsDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
FreeLibrary
DeleteFileA
HeapFree
CloseHandle
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
SetFilePointer
Sleep
GetLocalTime
WaitForSingleObject
CreateProcessA
GetStartupInfoA
CreatePipe
WaitForMultipleObjects
Process32Next
Process32First
CreateToolhelp32Snapshot
WritePrivateProfileStringA
GetTickCount
GetPrivateProfileIntA
GetSystemDirectoryA
CreateMutexA
OpenMutexA
GetModuleFileNameA
GetModuleHandleA
CreateThread
WriteFile
GlobalAlloc
GlobalFree
LoadLibraryW
ExpandEnvironmentStringsW
WideCharToMultiByte
GetVersionExA
GetVersion
GetStdHandle

ws2_32

send
connect
htons
inet_addr
socket
closesocket
gethostbyname
WSCEnumProtocols
WSCGetProviderPath
WSACleanup
WSAStartup
inet_ntoa

user32

wsprintfA
wvsprintfA

Exports

Exports

WSPStartup
Wait

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71d0ed43e6e0cabf5ee96f724462db81

Headers

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

user32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 29KB

Shared Size: 512B - Virtual size: 4B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 29KB

Shared
Size: 512B - Virtual size: 4B

.reloc
Size: 1KB - Virtual size: 1KB