c2607c43b746eb6ada53abf1a045a492

Sharing

Copy URL

Twitter E-mail

General

Target

c2607c43b746eb6ada53abf1a045a492
Size

104KB
MD5

c2607c43b746eb6ada53abf1a045a492
SHA1

3d48c29b2824c06cc2f607a094aa133e1cea2cc5
SHA256

c5d89ff9b459b2eb4e3d483b196a78f87420d6a6b8287b1da349d1347c544779
SHA512

6cc4bb769eac6b9ded83ddbb749e484f2e5b48cadd2a5d81f5b7164b2bf0ca56b330e524642a7e4859fc31982bfc0eadb5c5dbce053916e1f2045ebdef92d237
SSDEEP

1536:zHC1KsXOZHnxT2FDAVub4gUSxtLyq9rFiFc6:ziQngnp1Lyq9rFiFc6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2607c43b746eb6ada53abf1a045a492

Files

c2607c43b746eb6ada53abf1a045a492
.dll windows:4 windows x86 arch:x86

930a9c1769a88c1b9ec7d510172559d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetVersion
InterlockedIncrement
WriteFile
SetFilePointer
GetCurrentProcessId
Sleep
LocalFree
ResumeThread
CloseHandle
GetModuleFileNameA
WideCharToMultiByte
ExitProcess
SetHandleCount
CreateRemoteThread
WaitForSingleObject
OpenProcess
DuplicateHandle
VirtualAlloc
VirtualFree
ReadProcessMemory
WriteProcessMemory
VirtualQuery
GetExitCodeThread
SuspendThread
TerminateThread
GetThreadContext
SetThreadContext
RtlUnwind
GetCommandLineA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
HeapFree
HeapAlloc
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
HeapReAlloc
GetACP
GetOEMCP
LoadLibraryA
SetStdHandle
GetStringTypeA
GetStringTypeW
FlushFileBuffers

user32

MessageBoxA

advapi32

RegDeleteValueA
RegCreateKeyA
RegEnumValueA
RegCloseKey
RegOpenKeyA
RegSetValueExA

Exports

Exports

AddHiddenFileDir
AddHiddenKey
AddHiddenProcId
AddHiddenProcName
AddHiddenServ
AddHiddenValue
ApiHookChain
DelHiddenFileDir
DelHiddenKey
DelHiddenProcId
DelHiddenProcName
DelHiddenServ
DelHiddenValue
GetHiddenFileDirName
GetHiddenKeyName
GetHiddenProcId
GetHiddenProcName
GetHiddenServName
GetHiddenValueName
Hook_Start
Hook_Stop
HooksCanUnloadNow

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ApiHooks
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

930a9c1769a88c1b9ec7d510172559d2

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 29KB

ApiHooks Size: 16KB - Virtual size: 12KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 28KB

.SHARDAT Size: 28KB - Virtual size: 24KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 29KB

ApiHooks
Size: 16KB - Virtual size: 12KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 28KB

.SHARDAT
Size: 28KB - Virtual size: 24KB

.reloc
Size: 8KB - Virtual size: 4KB