d7123ee60babb5ac1fd214050fbcfab4bb76217dd45bda3aea49ab1b92632aa4

Sharing

Copy URL Twitter E-mail

General

Target

d7123ee60babb5ac1fd214050fbcfab4bb76217dd45bda3aea49ab1b92632aa4
Size

14KB
MD5

d2d97bdd2d95bc3c9498c091e7501312
SHA1

aed29db2d5a8868e00fa7f836ac5e4d514205a5a
SHA256

d7123ee60babb5ac1fd214050fbcfab4bb76217dd45bda3aea49ab1b92632aa4
SHA512

7f477682a7d2ff01e31879d140965e61ad997b5455857041d067d9bc2834c54535a2ded3c79c809d391a8959998b898904b04f643a58dc49e846f8d27e204170
SSDEEP

384:bkaemBEHmyfFLD2o7+kYix6GGkDSOy1s8:43POfh/kPyV

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/H_Hayat_x32.dll
unpack001/version.dll

Files

d7123ee60babb5ac1fd214050fbcfab4bb76217dd45bda3aea49ab1b92632aa4
.zip
H_Hayat_x32.dll
.dll windows:6 windows x86 arch:x86

da64422053313b31b467c7ae51b9ae46

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\hayat\Documents\Visual Studio 2019\repos\H_Hayat_x32\Release\H_Hayat_x32.pdb

Imports

kernel32

VirtualProtect
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
UnhandledExceptionFilter

vcruntime140

memcpy
__std_type_info_destroy_list
memset
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_cexit
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment

Exports

Exports

FindPattern
Patch

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Readme.txt
version.dll
.dll windows:6 windows x86 arch:x86

ee1d9bb227e7158c9a93e1b6b884315b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\hayat\Documents\Visual Studio 2019\repos\EdrawMax HOOK\EdrawMax HOOK\Release\version.pdb

Imports

kernel32

K32GetProcessImageFileNameW
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32NextW
CloseHandle
LoadLibraryA
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter

user32

MessageBoxW

msvcp140

?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_exception_destroy
__std_exception_copy
memcpy
__CxxFrameHandler3
_except_handler4_common
memmove
memset
memchr
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
exit
_execute_onexit_table
_errno
_invalid_parameter_noinfo_noreturn
_initterm

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

Exports

Exports

??0CEdrawMaxHOOK@@QAE@XZ
??4CEdrawMaxHOOK@@QAEAAV0@$$QAV0@@Z
??4CEdrawMaxHOOK@@QAEAAV0@ABV0@@Z
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da64422053313b31b467c7ae51b9ae46

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 912B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 328B

ee1d9bb227e7158c9a93e1b6b884315b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 660B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 912B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 328B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 660B