ad1a2872f566d678ce368929a8058f0d

Sharing

Copy URL Twitter E-mail

General

Target

ad1a2872f566d678ce368929a8058f0d
Size

62KB
MD5

ad1a2872f566d678ce368929a8058f0d
SHA1

aee3281948d483d176e4d622f091dd28192e6527
SHA256

e7548323a2c5a52ed949c5aea981ebca62aefbbca055a10a2ee6884cc5949ee7
SHA512

124dd0642c7672d1dad6c7517a39f4148fff91a5b8830fbed7041b590894bab95f8d5129c39b57b3127cb791f0a1a920686325399848b5e4b1f1a0a6fbee028d
SSDEEP

1536:FZ12tW2eJ0wRMqVA2tS8D6rd103/TK4jY34pfChb2:FZI/twRTA2Irk3/zpKl2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad1a2872f566d678ce368929a8058f0d

Files

ad1a2872f566d678ce368929a8058f0d
.dll windows:5 windows x86 arch:x86

6774c95d924a8cbb79790775eff7ae0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

SelectClipRgn
GetStockObject
SetTextColor
SetStretchBltMode
DeleteObject
GetDCOrgEx
CreateFontIndirectA
GetTextColor
GetClipBox

kernel32

GetStringTypeW
GetFullPathNameA
GetTimeZoneInformation
HeapFree
GetModuleHandleA
SetFilePointer
GetLogicalDrives
GetDateFormatA
ExitProcess
WaitForMultipleObjects
CreateFileMappingW
GetVersion
TerminateProcess
GetFileType
GetLocalTime
CloseHandle
GetProcAddress
TlsSetValue
DuplicateHandle
lstrcpyA
lstrlenW
GetOEMCP
VirtualQueryEx
MultiByteToWideChar
MapViewOfFileEx
LoadLibraryA
GetComputerNameW
LocalAlloc
GetACP
FileTimeToSystemTime
RaiseException
IsValidCodePage
HeapAlloc
FindClose
GetCurrentThread
GetStringTypeA
GetEnvironmentStrings
GetDriveTypeA
CloseHandle
IsValidLocale
FileTimeToLocalFileTime

user32

IntersectRect
SendDlgItemMessageA
GetWindowRect
SetFocus
ClientToScreen
MapDialogRect
EnableWindow
SetParent
GetCaretPos
CreateCaret
EnumChildWindows
LockWindowUpdate
CharToOemBuffA
ShowCaret
IsIconic
GetCursorPos
GetForegroundWindow
CheckMenuItem
wsprintfA
IsWindowVisible
ReleaseDC
ShowWindow
SetWindowPos
MessageBoxA
RegisterClipboardFormatA
AppendMenuA
DestroyWindow
OffsetRect
GetClientRect
GetWindowPlacement

bitstpub

_LNan
_LRteps
_FDscale
_Hugeval
_Getctype
_Eps
_Rteps
_LExp
_LSinh
_FExp
_Poly
_Denorm
_Getcvt
_LCosh
_FDenorm
_FSinh
_Toupper
_Sinh
_Dscale
_Snan
_Dnorm

ole32

RevokeDragDrop
OleInitialize
DoDragDrop
OleUninitialize

comctl32

ImageList_SetDragCursorImage
PropertySheetA
ImageList_EndDrag
ImageList_GetDragImage
CreatePropertySheetPageA

shell32

SHBrowseForFolderA

Exports

Exports

ApphelpUpdateCacheEntry
SdbCloseApphelpInformation
AllocADsStr
FreeObjectInfo
AdsTypeToLdapTypeCopyTime
ConvertSidToU2Trustee
CreateProcessNotify
DllClientCleanup
dumprcp
ChangeSeparator
BuildADsParentPath
DllClientStartup
FindEntryInSearchTable
GetLDAPTypeName
ConvertSidToString
BuildLDAPPathFromADsPath
FreeADsStr
FreeADsMem
ConvertU2TrusteeToSid
AdsTypeToLdapTypeCopyGeneralizedTime

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6774c95d924a8cbb79790775eff7ae0a

Headers

File Characteristics

Imports

gdi32

kernel32

user32

bitstpub

ole32

comctl32

shell32

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 56KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 56KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB