9b57bbeb7a77e9ff4256defe7141bab3

Sharing

Copy URL

Twitter E-mail

General

Target

9b57bbeb7a77e9ff4256defe7141bab3
Size

424KB
MD5

9b57bbeb7a77e9ff4256defe7141bab3
SHA1

3d2adf3e0ebac41aadfd122f119786127ea42e0c
SHA256

bb947e54137e56040819eefd51990978b28ac3291fb729447470a67f240be1ad
SHA512

d3efd3ddaa265f7e1e5b8cd496738a7a4799ec5f479f87c9cbdfd3177f9085e378891345515a7c26e8802b1a7be8158e72a35e006a24c842e76d73683c3b7f53
SSDEEP

6144:i/0z/2rEZgcwPDHTSNT/rANdYdtGinqRfvTqDeFul0Mh5TBWQOX6JHY2DbAV0Zg:007/XwboTzAN2tnqRfCevM7TBw0Z4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b57bbeb7a77e9ff4256defe7141bab3

Files

9b57bbeb7a77e9ff4256defe7141bab3
.dll windows:5 windows x86 arch:x86

56ccd1abfeddd3fa60f44c9363f3916a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

BuildCommDCBW
DeviceIoControl
DnsHostnameToComputerNameA
EnumDateFormatsW
EnumResourceLanguagesW
ExitProcess
FlushInstructionCache
FreeConsole
GetACP
GetCommandLineA
GetCurrencyFormatA
GetCurrentThread
GetMailslotInfo
GetProcessAffinityMask
HeapAlloc
IsValidLanguageGroup
OpenMutexA
RtlZeroMemory
SetCalendarInfoW
SetLastError
SetThreadLocale
SetUnhandledExceptionFilter
SetVolumeLabelA
VerLanguageNameA
VirtualAlloc
VirtualFree
WriteProfileSectionA
_lwrite

version

VerFindFileA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA

ntdll

RtlExpandEnvironmentStrings_U
NtFsControlFile
RtlNtStatusToDosError
RtlSetThreadPoolStartFunc
ZwCreateProcess
ZwDeleteFile
ZwDuplicateObject
RtlLookupElementGenericTable

userenv

RegisterGPNotification
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserW
FreeGPOListW
GetAppliedGPOListW
CreateEnvironmentBlock
UnregisterGPNotification
DestroyEnvironmentBlock
LeaveCriticalPolicySection
GetProfilesDirectoryW

crtdll

freopen
_mbctoupper
_initterm
_finite
_exit

rpcrt4

IUnknown_Release_Proxy
float_from_ndr
double_from_ndr
RpcSsSetThreadHandle
RpcSmSetClientAllocFree
RpcServerUseAllProtseqsIfEx
RpcServerUseAllProtseqsIf
RpcServerUseAllProtseqsEx
RpcServerInqIf
RpcServerInqDefaultPrincNameA
RpcObjectSetInqFn
RpcMgmtInqIfIds
RpcCancelThread
RpcBindingToStringBindingA
RpcBindingInqAuthClientA
RpcAsyncInitializeHandle
CStdStubBuffer_IsIIDSupported
MIDL_wchar_strcpy

Exports

Exports

QycxlbausdduXyeiHl
bjymcwxotzph
bpszx
cgmih
ejbqgujqXhNmdce
hkicjcc
iddntcjB
kfDxseJW
lalOLytDvUsik
pbdjustvyNdudVlYoA
rnkyfyrWxVl
sfzejHysvsp
tMccBib
wBsIxoLsx
yJItUbdyexsxLEzalme
yvO
zMerkl

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 362KB - Virtual size: 691KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56ccd1abfeddd3fa60f44c9363f3916a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

version

ntdll

userenv

crtdll

rpcrt4

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.data Size: 362KB - Virtual size: 691KB

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 34KB - Virtual size: 33KB

.data
Size: 362KB - Virtual size: 691KB

.rsrc
Size: 26KB - Virtual size: 26KB