98eb58ffa1e7cae4ed4ef081fc869a6f

Sharing

Copy URL

Twitter E-mail

General

Target

98eb58ffa1e7cae4ed4ef081fc869a6f
Size

112KB
MD5

98eb58ffa1e7cae4ed4ef081fc869a6f
SHA1

823e4a240a765c3b07065e30fa3137ef50ec38d9
SHA256

8c5e6f08fc1acb635869c7fb23f71509587ed281ff93c4ee15eaef6f9b095525
SHA512

0478e6df1d50bbda932ed768eb1811c6d29a556d4112625e4509d19b13f0a9d0116bfb97a00839fda57c54271415d45ff9a8a03c4d92d0c12e35c03513ac05de
SSDEEP

3072:xSKgAn29PVf0wmnlNDMNyhqAHTBf+q+ktLg+U:xtgAcxIM8oAHTBmZktLPU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
98eb58ffa1e7cae4ed4ef081fc869a6f

Files

98eb58ffa1e7cae4ed4ef081fc869a6f
.dll windows:4 windows x86 arch:x86

b00f60cb32f3027d77ac0c4783523ad3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\_Home\_LocalSource\Bender\release_dbg\BenderDll.pdb

Imports

ntdll

strncpy
_atoi64
_ui64toa
_stricmp
_snprintf
strstr
strlen
_itow
_wtoi
memcmp
memcpy
atoi
_itoa
_ultoa
tolower
_strnicmp
_alldiv
_chkstk
memset
_allmul

msvcrt

strtok

ws2_32

listen
WSAWaitForMultipleEvents
shutdown
setsockopt
bind
WSAGetOverlappedResult
WSACreateEvent
ntohl
WSAGetLastError
WSASend
ntohs
getsockname
WSASetLastError
WSAIoctl
closesocket
WSAStartup
WSARecv
WSASocketW

wininet

InternetCloseHandle
InternetOpenUrlA
InternetConnectA
HttpOpenRequestA
InternetReadFile
HttpAddRequestHeadersA
InternetWriteFile
HttpSendRequestA
HttpSendRequestExA
InternetOpenA

kernel32

TerminateThread
GetVolumeInformationA
GetFileTime
HeapSetInformation
HeapFree
HeapAlloc
HeapCreate
HeapDestroy
GetVersionExA
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
FreeLibrary
ExitProcess
LoadLibraryA
GetFileAttributesExA
TlsSetValue
TlsAlloc
TlsGetValue
CreateEventA
ProcessIdToSessionId
Process32Next
VirtualAllocEx
VirtualFreeEx
OpenProcess
CreateRemoteThread
Process32First
WriteProcessMemory
DeleteFileA
GetSystemTime
GetTickCount
CreateProcessA
MultiByteToWideChar
lstrcmpW
SetLastError
FlushInstructionCache
VirtualQuery
ResumeThread
SuspendThread
CloseHandle
GetProcAddress
GetCurrentProcessId
OpenThread
Thread32First
InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
Thread32Next
CreateToolhelp32Snapshot
GetCurrentThreadId
SystemTimeToFileTime
OpenMutexA
GetCurrentProcess
LeaveCriticalSection
GetExitCodeThread
OpenEventA
WaitForSingleObject
InterlockedCompareExchange
ReadFile
GetModuleFileNameW
SetEvent
WaitForMultipleObjects
lstrcatA
GetCurrentThread
GetModuleFileNameA
VirtualFree
FlushFileBuffers
WriteFile
GetLastError
CreateMutexA
CreateFileA
lstrcmpiA
GetFileSize
InitializeCriticalSection
DuplicateHandle
EnterCriticalSection
ReleaseMutex
lstrlenA
SetThreadContext
GetFileInformationByHandle
ResetEvent
SetUnhandledExceptionFilter
CreateThread
Sleep
GetLocalTime
lstrcpyA
GetTempPathA
VirtualAlloc
GetWindowsDirectoryA
GetTempFileNameA
GetFileAttributesA
lstrcmpA
SetFilePointer
DeleteCriticalSection
SetEndOfFile
VirtualProtect
GetThreadContext

user32

ShowWindow
PeekMessageA
GetSystemMetrics
wsprintfA
MsgWaitForMultipleObjects
SetForegroundWindow
DispatchMessageA

advapi32

RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA

shell32

ShellExecuteA

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

Exports

Exports

DllGetClassObject
EventStartup

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b00f60cb32f3027d77ac0c4783523ad3

Headers

File Characteristics

PDB Paths

Imports

ntdll

msvcrt

ws2_32

wininet

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 70KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 72KB - Virtual size: 70KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 6KB