9749a8664230d79b097bdef1d56d3eac

Sharing

Copy URL Twitter E-mail

General

Target

9749a8664230d79b097bdef1d56d3eac
Size

282KB
MD5

9749a8664230d79b097bdef1d56d3eac
SHA1

48b678162fb6ada9c7f5c58ddbf65ab018298e44
SHA256

3fb6b99400734f9c49c77724d76647d6a7490395dd38e1d09b3209f84a39a666
SHA512

be82b0763c2b6acc936d4fd124e9035289c8a9a056eef4a4148ebbe656ddcc2918d383751d3e681876aeaa9ef24cbf1d7d28d1221c2b63a04c08534efd6ab056
SSDEEP

6144:EJgihq2pciZAiKDvB7ZvglcrTW1VGMyC:EaGCwA5Rglc/Wh5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9749a8664230d79b097bdef1d56d3eac

Files

9749a8664230d79b097bdef1d56d3eac
.dll windows:6 windows x86 arch:x86

0a4f588b247bd26fe97211b032edfb27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
MultiByteToWideChar
Sleep
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
SetEvent
GetNamedPipeHandleStateW
lstrcatW
GlobalAlloc
lstrcpyA
GlobalFree
CloseHandle
RaiseException
LoadLibraryW
GetProcAddress
VirtualAllocEx
DeleteCriticalSection
GetModuleHandleA
LocalAlloc
ReadProcessMemory
WideCharToMultiByte
lstrcpyW
TlsGetValue
VirtualFreeEx
CreateEventA
MulDiv
LoadLibraryExW
CreateTimerQueue
WriteConsoleW
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
lstrcatA
GetVolumeNameForVolumeMountPointA
ExitProcess
GetCurrentThreadId
FindClose
lstrlenA
CreatePipe
LeaveCriticalSection
VirtualAlloc
VirtualFree
EnterCriticalSection
SetLastError
TlsSetValue
CreateTimerQueueTimer
ReadFile
FindFirstFileA
SetNamedPipeHandleState
lstrcpynA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
EncodePointer
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsFree
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
WriteFile
GetConsoleCP
CreateFileW

user32

GetWindowThreadProcessId
FindWindowExW
GetDC
MapWindowPoints
FindWindowW
SetCursor
SetRectEmpty
ReleaseDC

gdi32

CreateDIBSection
PatBlt
BitBlt

advapi32

EqualSid
DeregisterEventSource
LsaSetDomainInformationPolicy
FreeEncryptionCertificateHashList
BuildTrusteeWithObjectsAndSidA
CredFree
GetEventLogInformation
LogonUserW
CredMarshalCredentialA
LsaOpenPolicy
LsaClose
RegisterEventSourceW
QueryAllTracesA

Exports

Exports

HG_Core_get_datas
HG_Core_get_outputs
HG_Get_infos
MSPNlpSchCancel
ServiceMain
hg_atomic_and32s
hg_atomic_queue_frees
hg_atomic_xor32s
hg_bulk_na_gets
hg_core_finalize_7e3be40s
hg_core_get_output_7e3be40s
hg_core_header_response_inits
hg_get_extra_input_cb_06cb694s
hg_more_data_free_cb_06cb694s
hg_proc_get_sizes
hg_request_creates
hg_thread_key_creates
hg_thread_spin_locks

Sections

.text
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a4f588b247bd26fe97211b032edfb27

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 238KB - Virtual size: 237KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 238KB - Virtual size: 237KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 10KB - Virtual size: 9KB