95c54da4db15f727a89d90ecfd892723

General

Target

95c54da4db15f727a89d90ecfd892723
Size

136KB
MD5

95c54da4db15f727a89d90ecfd892723
SHA1

c691cac0c97b129f0441d5d9433b639ee2432df2
SHA256

dd45619bbe7fc8a44fc4c7cd560fe5d472803ecf3ea0f7ab407c35ea8f0eef40
SHA512

01dadec015540a2efedbffb2fe2f432a8ab90134c5cb4df5f8e99c5531a4b4aa6ce3a0ee03cb226431fd8f5f01d1e0d64da59fcb62b09b676588335f783bfe26
SSDEEP

3072:j9e8vJBYLLcvHiTUlUOmR5pC/3r8yJonyk:jM4m3UH2vE8/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95c54da4db15f727a89d90ecfd892723

Files

95c54da4db15f727a89d90ecfd892723
.dll windows:4 windows x86 arch:x86

b728e3cb967ecbe912ef9a2ea4619126

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
DeleteFileA
GetModuleFileNameA
GetVersionExA
DeviceIoControl
GetModuleHandleA
CloseHandle
GetLastError
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
WriteFile
InitializeCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetEndOfFile
ReadFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind

advapi32

StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ControlService

Exports

Exports

GetPhysLong
GetPortVal
InitializeWinIo
InstallWinIoDriver
MapPhysToLin
RemoveWinIoDriver
SetPhysLong
SetPortVal
ShutdownWinIo
UnmapPhysicalMemory

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b728e3cb967ecbe912ef9a2ea4619126

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 100KB - Virtual size: 96KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 100KB - Virtual size: 96KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 1KB