c9ebcfafb4087f6578f7fa80f15fc4da

General

Target

c9ebcfafb4087f6578f7fa80f15fc4da
Size

66KB
MD5

c9ebcfafb4087f6578f7fa80f15fc4da
SHA1

f486ffda9023c4cf00c4b0e2d649211487c10d3d
SHA256

efd54634d3698a02420177f33acc77f0d3906258af2385fdce6191f0496e2386
SHA512

2d8b6bed1dd54139708862db3232cf986ca9daf12a0ef4ca3e8e1c095c094e6163597993dbf286d22a60f87ce111f035f23ec12073e177dcd64d193d6aaa5c46
SSDEEP

1536:oH1xVgJCDqc7bVsts2cCU080g6w4i9k4+7KCsn0:IVjDqGsQ0DzL7Zsn0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9ebcfafb4087f6578f7fa80f15fc4da

Files

c9ebcfafb4087f6578f7fa80f15fc4da
.dll windows:4 windows x86 arch:x86

e061566cb2b1124f461745b30321c8e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetPrivateProfileStringA
DisableThreadLibraryCalls
SearchPathA
LoadLibraryA
GetProcAddress
FreeLibrary
SetLastError
lstrlenA
ReadFile
CloseHandle
CreateFileA
DeleteFileA
GetCurrentProcessId
CreateEventA
GetVersionExW
LocalAlloc
LocalFree
InterlockedIncrement
lstrlenW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
InterlockedExchange
VirtualProtect
Sleep
InterlockedCompareExchange
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
DeviceIoControl

advapi32

RegOpenKeyExA
RegisterEventSourceW
DeregisterEventSource
RegDeleteKeyA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegEnumKeyExA
RegSetValueExA

msvcrt

__CxxFrameHandler
time
_except_handler3
??2@YAPAXI@Z
??3@YAXPAX@Z
_adjust_fdiv
_amsg_exit
free
_XcptFilter
memset
memcpy
_vsnprintf
wcscat
wcschr
wcsrchr
wcsncmp
wcscpy
wcslen
swprintf
sprintf
wcsncpy
wcsncat
_ltow
_initterm
malloc

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e061566cb2b1124f461745b30321c8e2

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 512B - Virtual size: 33KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 512B - Virtual size: 33KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 1KB - Virtual size: 1KB