976d35922802122d1d97d17a0ffc9eeb

General

Target

976d35922802122d1d97d17a0ffc9eeb
Size

19KB
MD5

976d35922802122d1d97d17a0ffc9eeb
SHA1

78ad483b1a84c54512172d2c5dc89499de7c0a8b
SHA256

b7d60624d398a407b48fdec22eeff380c136991e10e5eaa1baf176a74dd0eccf
SHA512

6498bc143eba7c1fd627f9c34068dfc0f1b524f633da5075eb31d105876a7583b088a1c7ce23fb234e0f148049203a47a0b91def7efed1417a6fb2265413fb3e
SSDEEP

384:IRMA48s4WuqbFODhI9U7lr2MwHb0yeK3afb:gs4lekhI9EaHb0ye8U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
976d35922802122d1d97d17a0ffc9eeb

Files

976d35922802122d1d97d17a0ffc9eeb
.dll windows:4 windows x86 arch:x86

4a9dc58bf4fa552d8fc34eb02187dba4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadProcessMemory
IsBadReadPtr
CloseHandle
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetProcAddress
LoadLibraryA
WriteProcessMemory
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetModuleFileNameA
CreateThread
OpenMutexA
CreateMutexA
GetCurrentProcess
VirtualProtectEx

user32

SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
FindWindowA

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

msvcrt

fclose
_stricmp
_adjust_fdiv
malloc
_initterm
free
wcslen
strcat
sscanf
strrchr
??3@YAXPAX@Z
strcpy
??2@YAPAXI@Z
sprintf
strlen
memcpy
strncpy
strchr
strstr
_strlwr
fread
fopen
memset
strcmp

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a9dc58bf4fa552d8fc34eb02187dba4

Headers

File Characteristics

Imports

kernel32

user32

wininet

msvcrt

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 4KB

sdt Size: 512B - Virtual size: 80B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 4KB

sdt
Size: 512B - Virtual size: 80B

.reloc
Size: 2KB - Virtual size: 1KB