75cb30f4366608785cc5331cd01e10c1563963e2a586fa20519cb8c5f4383f83

General

Target

75cb30f4366608785cc5331cd01e10c1563963e2a586fa20519cb8c5f4383f83
Size

122KB
MD5

d0b2ab87dad2ff41b7fe2683a1f08b4e
SHA1

b35e26c2dc8008b221e3f01e71774cd67f8785fb
SHA256

75cb30f4366608785cc5331cd01e10c1563963e2a586fa20519cb8c5f4383f83
SHA512

7d5698967c1d13030017dd982f2d3cfd463dc62674cb3463cd29befb68db6158cf21a1b0ccbee1cefbe94970d1b68a3f439b3eae50ec4e31a417d6f77bb33924
SSDEEP

1536:LVp++SPsiQvvGy5jMTSS9i00x7GTN2s+zheW6BVrqzCJ3bdDY+W14N4NmzWlIA7D:LaVy6V0x7w2lQBV+UdE+rECWp7hKpcn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75cb30f4366608785cc5331cd01e10c1563963e2a586fa20519cb8c5f4383f83

Files

75cb30f4366608785cc5331cd01e10c1563963e2a586fa20519cb8c5f4383f83
.dll windows:5 windows x86 arch:x86

15cf95070b7a4df0085c336ce6867741

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\work\vc\myprojects\ultradefrag\src\archive\4.4.0\ultradefrag-4.4.0\src\obj\udefrag-kernel\objfre_wnet_x86\i386\udefrag-kernel.pdb

Imports

ntdll

NtSetEvent
_strupr
NtClearEvent
NtWaitForSingleObject
_wcslwr
wcslen
wcsstr
_wtol
_snprintf
_snwprintf
RtlFreeUnicodeString
_allmul
_aulldiv
_wcsupr
wcscmp
NtClose
RtlCreateUnicodeString
wcschr
NtCreateFile
NtFsControlFile
wcscpy
wcsncpy
NtQueryDirectoryFile
RtlInitUnicodeString
_alldiv
NtReadFile
_aullrem

zenwinx

winx_dbg_print
winx_list_insert_item
winx_heap_alloc_ex
winx_list_destroy
winx_heap_free
winx_dfbsize
winx_query_env_variable
winx_create_event
winx_destroy_event
winx_get_os_version
winx_dbg_print_ex
winx_xtime
winx_get_volume_information
winx_list_remove_item
winx_wcsistr
winx_delete_file
winx_fwrite
winx_fclose
winx_fopen
winx_fbopen
winx_fflush

Exports

Exports

udefrag_kernel_get_statistic
udefrag_kernel_native_init
udefrag_kernel_native_unload
udefrag_kernel_start
udefrag_kernel_stop

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15cf95070b7a4df0085c336ce6867741

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

zenwinx

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 1008B

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 1008B

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 3KB - Virtual size: 2KB