f764550979e677b2207ae4766f6175df1f53c3df14d5434b37f968b6d5c5001a

Sharing

Copy URL Twitter E-mail

General

Target

f764550979e677b2207ae4766f6175df1f53c3df14d5434b37f968b6d5c5001a
Size

397KB
MD5

ceea8495e9ea426e880c03083d160f07
SHA1

505f95ce6f771a5fe007aa00186b380ea4307feb
SHA256

f764550979e677b2207ae4766f6175df1f53c3df14d5434b37f968b6d5c5001a
SHA512

8da051f9279213c2417b9b73c5c5b37545afc654b0ba0970acf848a5ba67f7ff01489cc2561be476a0e3e1223e45ba01a3003256c4d03b1f989f9f7612bf7eb5
SSDEEP

6144:iw74RCKwdpdVNthcIHSzMoiHBTPjK5yVVtqvjzFmDkacitdN8lD7cVj:igkdwpVLNqMoiHZ+kHOjoTcit3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f764550979e677b2207ae4766f6175df1f53c3df14d5434b37f968b6d5c5001a

Files

f764550979e677b2207ae4766f6175df1f53c3df14d5434b37f968b6d5c5001a
.dll windows:6 windows x86 arch:x86

b1e4013786951f77649279481e0b7f8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\OBS---DWM绘制\DwmDraw离线\Release\DwmDraw.pdb

Imports

kernel32

GetCurrentProcess
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
LoadLibraryA
GetProcAddress
OpenProcess
HeapFree
GetProcessHeap
HeapAlloc
TerminateProcess
CloseHandle
LoadResource
LockResource
SizeofResource
WaitForSingleObject
GetModuleHandleW
VirtualFreeEx
VirtualAllocEx
IsWow64Process
IsProcessorFeaturePresent
IsDebuggerPresent
Process32Next
Process32First
FindResourceA
CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer

user32

MessageBoxA

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

msvcr120

_initterm
_initterm_e
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_malloc_crt
_amsg_exit
__CppXcptFilter
malloc
free
_wcsicmp
__CxxFrameHandler3
memset

Exports

Exports

_DrawEnd@0
_DrawStart@0
_InitDwmDraw@0
_StopDraw@0
__DrawBox@28
__DrawFillBox@28
__DrawLine@32
__DrawRound@24
__DrawStroketText@28
__DrawText@28

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 380KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1e4013786951f77649279481e0b7f8f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcr120

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 380KB - Virtual size: 379KB

.reloc Size: 1024B - Virtual size: 656B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 380KB - Virtual size: 379KB

.reloc
Size: 1024B - Virtual size: 656B