b917e1ac16f6a53742387e5984ad3b6f

Sharing

Copy URL Twitter E-mail

General

Target

b917e1ac16f6a53742387e5984ad3b6f
Size

225KB
MD5

b917e1ac16f6a53742387e5984ad3b6f
SHA1

1858da90c6d949733ea29b3344b237201d9ef859
SHA256

03b1546e181fb4b8d43f63456daa610a1767871aacd125ed6a59ade09f21c055
SHA512

1d531cd12a795f83901ec2d1f5cc5715e982cec2210923f74eb4f544e153a978b30c680259b8c10da5b8587e2d11f7bef5e3e89de1bd9c3d657eec337219004e
SSDEEP

3072:sC+e5JdA6Xvr3Txl2yIvZQWOmQixJMaySQ46MBXzO8M6AL/pog5MFtVXJc:d+gJhzDxlgvZQWQsacBXPw5StZJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b917e1ac16f6a53742387e5984ad3b6f

Files

b917e1ac16f6a53742387e5984ad3b6f
.dll windows:4 windows x86 arch:x86

0b956dbbdcc71758c02bc4cc21a736f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord6379
ord6466
ord538
ord2810
ord4155
ord6266
ord4831
ord2836
ord2099
ord1008
ord6451
ord3871
ord2385
ord5446
ord6390
ord1197
ord4371
ord4352
ord567
ord3635
ord3365
ord5286
ord4396
ord1768
ord6051
ord2574
ord693
ord6237
ord942
ord2520
ord771
ord496
ord6667
ord3281
ord5977
ord2634
ord6195
ord3867
ord3087
ord535
ord858
ord4197
ord4273
ord925
ord561
ord3733
ord3396
ord5710
ord4692
ord5298
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord815
ord3948
ord2717
ord5436
ord537
ord656
ord4238
ord3084
ord4470
ord1560
ord350
ord3611
ord3122
ord5647
ord1662
ord2644
ord268
ord6688
ord6211
ord5679
ord2776
ord5438
ord3313
ord665
ord5180
ord354
ord4279
ord4294
ord539
ord6921
ord6919
ord4270
ord3605
ord3397
ord6898
ord3993
ord6896
ord5706
ord927
ord3296
ord941
ord4272
ord6640
ord2755
ord2756
ord4124
ord3792
ord922
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord269
ord826
ord2036
ord2440
ord861
ord4847
ord641
ord2371
ord2859
ord1143
ord1637
ord2858
ord2430
ord4215
ord2576
ord3649
ord1165
ord3658
ord4370
ord4704
ord5830
ord5276
ord3592
ord324
ord4229
ord6024
ord4829
ord5155
ord5156
ord5154
ord4899
ord4736
ord4970
ord4942
ord5261
ord4848
ord4992
ord2506
ord6048
ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5283
ord3793
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord4419
ord3694
ord489
ord540
ord768
ord800
ord4253
ord2606
ord2910
ord5568
ord940
ord823
ord2388
ord3341
ord5296
ord4074
ord5303
ord5285
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord2248
ord1128
ord825

atl

ord15
ord43
ord44
ord45
ord32
ord16
ord21
ord18
ord22

ntdll

RtlCreateUnicodeString
RtlFreeUnicodeString

kernel32

ResetEvent
GetCurrentThreadId
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetVersion
GetFileAttributesW
GetProcAddress
WaitForSingleObject
SetEvent
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
GlobalSize
CreateEventW
DeleteCriticalSection
CloseHandle
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GlobalAlloc
GlobalFree
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetModuleFileNameW
OutputDebugStringA
GetTickCount
GlobalUnlock
GlobalLock
Sleep
LocalFree
LocalAlloc
MultiByteToWideChar
FindClose
FindFirstFileW
FormatMessageW
CompareStringW
GetCommandLineW
GetFullPathNameW
ExpandEnvironmentStringsW
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryA
VirtualAlloc
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
VirtualFree

oleaut32

SysStringLen
SysAllocString
SafeArrayGetVartype
VariantClear
VariantInit
VariantChangeType
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SafeArrayGetDim

ole32

CoInitialize
CoUninitialize
ReleaseStgMedium
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
StringFromGUID2

shlwapi

PathFindFileNameW
PathAddBackslashW
PathRemoveFileSpecW
PathStripPathW

secur32

TranslateNameW

dsuiext

ord10

ntdsapi

DsCrackNamesW
DsFreeNameResultW

activeds

ord13
ord9

Sections

CODE
Size: 182KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.abss
Size: - Virtual size: 472KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.atls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b956dbbdcc71758c02bc4cc21a736f5

Headers

File Characteristics

Imports

mfc42u

atl

ntdll

kernel32

oleaut32

ole32

shlwapi

secur32

dsuiext

ntdsapi

activeds

Sections

CODE Size: 182KB - Virtual size: 440KB

.abss Size: - Virtual size: 472KB

.pdata Size: 4KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 4KB

.atls Size: 4KB - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 25KB - Virtual size: 25KB

CODE
Size: 182KB - Virtual size: 440KB

.abss
Size: - Virtual size: 472KB

.pdata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 4KB

.atls
Size: 4KB - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 25KB - Virtual size: 25KB