86bef683c84c9f6a56b9b084d032b4f7

General

Target

86bef683c84c9f6a56b9b084d032b4f7
Size

27KB
MD5

86bef683c84c9f6a56b9b084d032b4f7
SHA1

0f0b27fda788541434a7e034be5bce5d43496e11
SHA256

7b11e3199511d56c46985fc025d426f458fb4bc6013851c28252d530407e3d56
SHA512

183634232dd47a6e2210488de8bf7c1a008f3d4b019c71ec7343518821d995bb5cdf2a9450da33a2e2ee40da5fa7fe418493edd4bd6947f297895e1201565d16
SSDEEP

384:xB+TB/NFnK9m7ZRT+kO3I+x+cR9MNV87bbCXUe5WNoAs:xGB/NMUT+kSx+cnMNqXboUe5W+As

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86bef683c84c9f6a56b9b084d032b4f7

Files

86bef683c84c9f6a56b9b084d032b4f7
.dll windows:4 windows x86 arch:x86

99b706169352e99865a6f2e9617eb0b7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
Process32Next
DeleteFileA
GetVersionExA
OpenProcess
lstrcpyA
lstrcatA
SetEvent
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
CloseHandle
GetTempFileNameA
GetFileAttributesA
CreateFileA
GetSystemDefaultUILanguage
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
ReleaseMutex
CreateEventA
CreateMutexA
CreateThread
lstrcmpA
ResetEvent
CompareStringA
SetEndOfFile
SetFilePointer
Process32First

user32

wsprintfA
CharUpperA

advapi32

CryptDecrypt
SetSecurityDescriptorDacl
CreateProcessAsUserA
RegSetValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptEncrypt
CryptDeriveKey
CryptHashData
OpenProcessToken
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptCreateHash
CryptAcquireContextA
InitializeSecurityDescriptor

wininet

InternetGetConnectedState
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
InternetConnectA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99b706169352e99865a6f2e9617eb0b7

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

iphlpapi

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB