be829e2de9a52ef6d5076a0c18debd34

Sharing

Copy URL Twitter E-mail

General

Target

be829e2de9a52ef6d5076a0c18debd34
Size

13KB
MD5

be829e2de9a52ef6d5076a0c18debd34
SHA1

a115743fd57ae042e78ff6db11e833db0c819732
SHA256

c3cdd93f5ede4660071df5ea5712ec2271da2882e842292168d9c889e08e2447
SHA512

da2c3373a696bfdbf646ffec30d5921d961a4ad822d580009f833486637475bf11770a5a5db74049a02326b28ad20126eb9da0315695383d582cc1be7b5a4d4e
SSDEEP

384:7cNAtbkrYwWMKZkkp19DIat/GgXn2pP2:4NykcJTJ9DlGgXn2x2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be829e2de9a52ef6d5076a0c18debd34

Files

be829e2de9a52ef6d5076a0c18debd34
.dll windows:4 windows x86 arch:x86

b32d13594e12af163b40bafcc9dd299e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
Process32Next
Sleep
Process32First
lstrcatA
lstrcpyA
lstrlenA
WriteProcessMemory
VirtualProtectEx
GetCurrentProcessId
TerminateProcess
LoadLibraryA
GetSystemDirectoryA
ExitProcess
GetProcAddress
CreateMutexA
TlsFree
TlsAlloc
DisableThreadLibraryCalls
VirtualFree
ReadFile
VirtualAlloc
GetFileSize
CreateFileA
FreeLibrary
GlobalFree
LoadLibraryExA
GlobalAlloc
WriteFile
CreateRemoteThread
WaitForSingleObject
CreateToolhelp32Snapshot
Module32First
lstrcmpiA
Module32Next
GetCurrentProcess
GetLastError
CreateThread
CloseHandle

user32

TranslateMessage
DispatchMessageA
GetMessageA
wsprintfA
MessageBoxA

advapi32

RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegOpenKeyExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
OpenProcessToken

shell32

ShellExecuteA

msvcrt

_except_handler3
_adjust_fdiv
malloc
_initterm
free
_strcmpi

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumPageFilesA
EnumPageFilesW
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetPerformanceInfo
GetProcessImageFileNameA
GetProcessImageFileNameW
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
MyEntryPoint
QueryWorkingSet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 602B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b32d13594e12af163b40bafcc9dd299e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 602B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 602B