865e7b07ad67f7adb2bc00425a922a0b

Sharing

Copy URL Twitter E-mail

General

Target

865e7b07ad67f7adb2bc00425a922a0b
Size

64KB
MD5

865e7b07ad67f7adb2bc00425a922a0b
SHA1

269c2566ef56e58308ee1dd1fc578255005d1e62
SHA256

78a3d035db38df27b3b461cec5293b572633ec01846d1541fd80991a8911a37b
SHA512

5919b3208e8765bfb2b5013ced76dabbd523de08de9aa06d204fe85384167b371959f43c0c7c940c76f54cb006951c69c21b323fd666bdfd83a0f3ef4bdb1922
SSDEEP

1536:vHQG9dCgTvEEMsZtvIoJyd3D8+Niwl0Cmp5:vHQ6dCgVdJ+NiwlNa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
865e7b07ad67f7adb2bc00425a922a0b

Files

865e7b07ad67f7adb2bc00425a922a0b
.dll windows:5 windows x86 arch:x86

10d4e4ed4db62c0ccf891eb98d6b64b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
ExitProcess
Sleep
GetVersion
CreateProcessA
CloseHandle
WriteFile
CreateFileA
lstrcpynA
CreateEventA
GetVersionExA
lstrcmpA
VirtualAlloc
VirtualFree
lstrcmpiA
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
GetSystemTime
MoveFileA
GetCurrentThreadId
WritePrivateProfileStringA
GetWindowsDirectoryA
MoveFileExA
GetTempPathA
CreateMutexA
GetTickCount
GetLocaleInfoA
GetVolumeInformationA
SetEvent
GetFileSize
SystemTimeToFileTime
GetProcessHeap
HeapFree
ReadFile
HeapAlloc
GetTempFileNameA
DeleteFileA
GlobalAlloc
VirtualQueryEx
GetThreadContext
GlobalFree
TerminateProcess
ResumeThread
RtlUnwind
VirtualQuery
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
OpenProcess
FindAtomA
lstrlenA
lstrcpyA
lstrcatA
GetModuleHandleA
GetLastError
GetProcAddress
RaiseException
ReleaseMutex
GetModuleFileNameA

user32

CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
GetWindowTextA
CloseDesktop
SetThreadDesktop
GetThreadDesktop
OpenInputDesktop
MessageBoxA
GetMessageA
SetWindowsHookExA
PostMessageA
FindWindowExA
GetWindowThreadProcessId
EqualRect
ClientToScreen
GetCursorPos
IsWindowVisible
wsprintfA
GetFocus
InflateRect
TranslateMessage
DispatchMessageA
CallNextHookEx
FindWindowA

advapi32

RegCloseKey
RegDeleteValueA
RegEnumValueA
RegDeleteKeyA
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
OpenProcessToken
CreateProcessAsUserA
RegCreateKeyExA

shlwapi

SHDeleteValueA
SHGetValueA
SHSetValueA
SHDeleteKeyA

Exports

Exports

QSXdHOgKn
SsNQYkpFJu
VdjgLNnE
jGtbcTPDAra
yDsIyNhQ

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10d4e4ed4db62c0ccf891eb98d6b64b5

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 52KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 13KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 53KB - Virtual size: 52KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 13KB

.reloc
Size: 3KB - Virtual size: 3KB