a14273af8ccd84ed31f329a7aa222fcc

Sharing

Copy URL Twitter E-mail

General

Target

a14273af8ccd84ed31f329a7aa222fcc
Size

12KB
MD5

a14273af8ccd84ed31f329a7aa222fcc
SHA1

87b4a180f68e5b506ef96731e0fbb3d4fd123e76
SHA256

e73464d64ae9aeda37a02cbb94e35881ae89ecf3d664b7f3bda1b8eb74d54316
SHA512

41ddd8c4a427350f73caf939c656f35bf4d31cf3831d6502c12d168b617046197df683ab5c9932d0521e51abb6cedf30495ada81687f15531ba12e2b495d4595
SSDEEP

192:SqcVarcEFylJLBOYgdqaTWAOTfsgdNAlhfQ2D3X+8qZpw3oSZRf:SqcVAcE0iYETWdTldalnuXM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a14273af8ccd84ed31f329a7aa222fcc

Files

a14273af8ccd84ed31f329a7aa222fcc
.dll windows:5 windows x86 arch:x86

47976f08801930f3423f09793ed72af0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Documents and Settings\Windows XP\My Documents\Visual Studio 2008\Projects\Gunz\GunzExp\Release\GunzExp.pdb

Imports

kernel32

GetCurrentProcess
Sleep
FlushInstructionCache
DisableThreadLibraryCalls
VirtualProtect
CreateThread
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId

user32

GetAsyncKeyState

msvcp90

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

msvcr90

_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
_amsg_exit
_lock
_onexit
_except_handler4_common
_malloc_crt
_encode_pointer
vsprintf_s
free
_initterm
_decode_pointer
__dllonexit
_encoded_null
memcpy
_initterm_e
__CxxFrameHandler3

Exports

Exports

_DllMain@12

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 906B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47976f08801930f3423f09793ed72af0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 992B

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 1024B - Virtual size: 906B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 992B

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 1024B - Virtual size: 906B