b727066b50dc63436ec3b0c008c651d8

Sharing

Copy URL Twitter E-mail

General

Target

b727066b50dc63436ec3b0c008c651d8
Size

61KB
MD5

b727066b50dc63436ec3b0c008c651d8
SHA1

5d8cc3cd85a704fff32dae6ad14a4ed0c1cc0642
SHA256

d293ff361ff666d867e5f167d96984e9eeff29c38a9dce705e31afd25ef8994a
SHA512

398be71140acfece52c27a36ffff5b333022f4b2c9ac5c2adb1e312d01b99d7fbf5496167561e31f832e65c4cf6884b5edb78336fcb8e1e1066d64d6d9a9255d
SSDEEP

1536:oKe6azr8/KHtS0TRgyi/omO9eCXsXEvAS4yAjYHLJxsrPE:n0/wKPTHs6e29OuLJO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b727066b50dc63436ec3b0c008c651d8

Files

b727066b50dc63436ec3b0c008c651d8
.dll windows:5 windows x86 arch:x86

8d766f6f772a49a96fb87eb515d1cd74

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
TerminateProcess
WaitForSingleObject
CreateProcessA
GetProcAddress
VirtualQueryEx
GetCurrentDirectoryA
FindClose
WritePrivateProfileStructA
VirtualFree
CopyFileA
MapViewOfFile
WriteFile
WaitForMultipleObjects
lstrlenA
GetFileAttributesA
FindFirstFileA
ResumeThread
WritePrivateProfileStringA
GetModuleFileNameA
GetModuleHandleA
GlobalAlloc
SetThreadPriority
FindNextFileA
lstrcmpA
VirtualQuery
GetCurrentThread
VirtualAlloc
GlobalLock
GetVersion
WideCharToMultiByte
GetPrivateProfileStructA
GlobalUnlock
SetCurrentDirectoryA
IsBadReadPtr
LoadLibraryA
lstrlenW
VirtualProtectEx
GetCommandLineA
VirtualLock
lstrcpynA
ReadFile
SetEndOfFile
GetComputerNameA
lstrcatA
CreateFileMappingA
CreatePipe
UnmapViewOfFile
SetFilePointer
VirtualUnlock
Sleep

openrfos

_LRteps
_Rteps
_Mbrtowc
_Hugeval
_Sinh
_LExp
_Wcrtomb
_FInf
_Xbig
_LEps
_Strxfrm
_Nan
_FXbig
_FSinh
_FSnan
_FRteps
_LNan
_Getctype
_FDenorm
_LDenorm
_FEps
_LSnan
_Getcoll
_LDtest
_LSinh
_LXbig
_Poly
_LPoly
_FExp
_Inf
_Toupper

imagehlp

CheckSumMappedFile

msvcrt

_timezone
asctime
mktime
_except_handler3
gmtime
strncmp
sprintf
strstr
div

user32

SetTimer
MoveWindow
CheckRadioButton
FindWindowA
IsWindowEnabled
InvalidateRect
wsprintfA
SetFocus
IsIconic
GetWindowTextA
CharUpperA
SetClassLongA
GetCursorPos
DialogBoxParamA
GetParent
CharLowerA
GetClipboardData
GetDlgItemTextA
SendMessageA
KillTimer
CheckMenuRadioItem
EnableMenuItem
SetForegroundWindow
GetAsyncKeyState
DestroyIcon
CreatePopupMenu
LoadCursorA
GetClassInfoA
LoadBitmapA
DestroyMenu
SetClipboardData

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
OpenProcessToken
RegSetValueExA

comdlg32

GetOpenFileNameA

Exports

Exports

SdbCloseApphelpInformation
CreateProcessNotify
DllClientCleanup
ddesnlpa
DllClientStartup
AdsTypeToLdapTypeCopyGeneralizedTime
BuildLDAPPathFromADsPath
AdsTypeToLdapTypeCopyTime
GetPermLayers
GetDomainDNSNameForDomain
ApphelpUpdateCacheEntry
BuildADsPathFromLDAPPath
GetDisplayName
GetDefaultServer
ConvertU2TrusteeToSid
BuildADsPathFromParent
ConvertSidToU2Trustee
GetLDAPTypeName
FreeADsStr
ChangeSeparator
Component
BuildADsParentPath

Sections

.text
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d766f6f772a49a96fb87eb515d1cd74

Headers

File Characteristics

Imports

kernel32

openrfos

imagehlp

msvcrt

user32

advapi32

comdlg32

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 52KB

.rdata Size: 4KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 51KB - Virtual size: 52KB

.rdata
Size: 4KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB