8eb7400236e04390be6dab7f2b43cbed

Sharing

Copy URL

Twitter E-mail

General

Target

8eb7400236e04390be6dab7f2b43cbed
Size

192KB
MD5

8eb7400236e04390be6dab7f2b43cbed
SHA1

74af43f06663e2d80f373fa30de55427ee199157
SHA256

c26a1cb69bdeb500b500fc28ba95a26f0215ed1fa040e115dcbca7f95f4c9ed3
SHA512

46eac187bd1eec6cde17ee3e3cb50ea17390063c13683426989d20da14902d4dff339587dd71634655e54e3219bf97f1f0d0ccbe417ace154f88ae75a524a340
SSDEEP

6144:l4Gv3Nuxx6zH1runjncn5nonwXOi7tTTBPpr3Jg:l3vmanOi7tTTFp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8eb7400236e04390be6dab7f2b43cbed

Files

8eb7400236e04390be6dab7f2b43cbed
.dll windows:3 windows x86 arch:x86

12c32157cfb6cf7bebf68cc869598a1e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MapViewOfFile
OpenEventA
ReadFile
ReleaseMutex
ResetEvent
SetEndOfFile
SetEvent
SetFilePointer
SetFileTime
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
CreateThread
ExitThread
FreeLibrary
GetCurrentThreadId
GetTickCount
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
IsBadReadPtr
SetErrorMode
HeapReAlloc
HeapSize
LoadLibraryA
GetLocalTime
GetLocaleInfoA
GetWindowsDirectoryA
FileTimeToSystemTime
GetCurrentProcess
GetDiskFreeSpaceA
GetDriveTypeA
GetFileTime
GetLogicalDrives
SetFileAttributesA
CreatePipe
DuplicateHandle
GetExitCodeProcess
PeekNamedPipe
ResumeThread
TerminateProcess
TerminateThread
GlobalFree
lstrlenA
lstrcmpiA
MultiByteToWideChar
GetFileSize
FormatMessageA
GetFileType
GetPrivateProfileSectionA
MoveFileA
VirtualAlloc
VirtualFree
WritePrivateProfileSectionA
HeapFree
HeapDestroy
HeapCreate
GetVolumeInformationA
GetVersion
GetTimeZoneInformation
GetTempPathA
CloseHandle
GetSystemTime
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFileAttributesA
GetCurrentProcessId
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
GetEnvironmentVariableA

advapi32

RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
GetUserNameA

user32

GetClassNameA
GetClipboardData
GetMessageTime
GetParent
IsClipboardFormatAvailable
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
RegisterClassA
SendMessageTimeoutA
SetWindowsHookExA
TranslateMessage
UnhookWindowsHookEx
DispatchMessageA
ExitWindowsEx
CharToOemBuffA
GetActiveWindow
SetClipboardData
EmptyClipboard
ShowWindow
SetWindowTextA
GetClientRect
SetWindowLongA
MoveWindow
SystemParametersInfoA
GetWindowLongA
LoadCursorA
DefWindowProcA
CreateWindowExA
CloseClipboard
CallNextHookEx
PostThreadMessageA
OemToCharBuffA
EnumWindows
MessageBoxA
UnregisterClassA
DestroyWindow

wsock32

shutdown
gethostname
WSAAsyncSelect
WSAGetLastError
bind
connect
inet_ntoa
listen
recv
send
getsockname
ioctlsocket
closesocket
accept
WSAStartup
socket
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
WSACancelAsyncRequest
WSACleanup
inet_addr

rpcrt4

UuidCreate

shell32

ShellExecuteA

ole32

CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
StringFromGUID2
OleInitialize

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound

Exports

Exports

DebugBreakpoint
DllCanUnloadNow
DllGetClassObject
Service
SpawnAndStart
Start
Uninstall

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12c32157cfb6cf7bebf68cc869598a1e

Headers

File Characteristics

Imports

kernel32

advapi32

user32

wsock32

rpcrt4

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 137KB - Virtual size: 136KB

.bss Size: - Virtual size: 16B

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 19KB - Virtual size: 18KB

.idata Size: 4KB - Virtual size: 4KB

shared Size: 10KB - Virtual size: 9KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 137KB - Virtual size: 136KB

.bss
Size: - Virtual size: 16B

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 19KB - Virtual size: 18KB

.idata
Size: 4KB - Virtual size: 4KB

shared
Size: 10KB - Virtual size: 9KB

.reloc
Size: 8KB - Virtual size: 8KB