cb3687a6f4a64f68c74489a9016d838f

Sharing

Copy URL Twitter E-mail

General

Target

cb3687a6f4a64f68c74489a9016d838f
Size

1.4MB
MD5

cb3687a6f4a64f68c74489a9016d838f
SHA1

a37bfe699edb39924581cb43684b31c7527645c7
SHA256

715e47afe7fac96777edddcb3a7c716a82c3f086bc0fb4f3a08a1901a09a923f
SHA512

45da67785d942a54f72fe8decea3e1515faf42720c3b2f060df54e97f1c942e1e3fa78ee772eb8a0200e23dce3277dcbd41e89568ef6e272f3a3aa5edb6ffb65
SSDEEP

12288:7rhe5BksljyCaUhN2Rsl46dUo0dBF71Xk25gxVU/xHWOi3QnmISvgteh:HSBks9yCaUhNY/xlim4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb3687a6f4a64f68c74489a9016d838f

Files

cb3687a6f4a64f68c74489a9016d838f
.dll windows:4 windows x86 arch:x86

39c9b0c85d619aafaa6ad22de2fd0ef1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFileTime
GetLocalTime
GetTimeZoneInformation
GetComputerNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
LoadLibraryExA
SystemTimeToFileTime
GetSystemTime
SetEvent
OpenProcess
ResumeThread
FindClose
FindNextFileA
FindFirstFileA
GetLocaleInfoA
CreateEventA
DuplicateHandle
FlushFileBuffers
SetEndOfFile
CreateThread
lstrcpynA
GetVersionExA
LocalFree
FormatMessageA
GetCurrentDirectoryA
VirtualQuery
GetSystemDirectoryA
GetProcessHeap
GetFullPathNameA
GetFileTime
DeleteFileA
HeapCreate
HeapFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetStringTypeW
GetStringTypeA
GetOEMCP
GetCPInfo
VirtualAlloc
VirtualFree
GetEnvironmentVariableA
HeapSize
HeapReAlloc
UnhandledExceptionFilter
TerminateProcess
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
TlsFree
TlsAlloc
GetCommandLineA
MoveFileA
GetSystemTimeAsFileTime
ExitThread
TlsGetValue
TlsSetValue
RaiseException
RtlUnwind
HeapAlloc
OutputDebugStringA
GetCurrentThreadId
GetACP
IsBadStringPtrA
IsBadReadPtr
IsBadWritePtr
GetFileAttributesW
GetFileSize
GetDriveTypeA
Sleep
QueryDosDeviceA
WideCharToMultiByte
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
DisableThreadLibraryCalls
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
GetCurrentProcess
FlushInstructionCache
SetLastError
GetCurrentProcessId
WaitForSingleObject
GetAtomNameA
ExitProcess
CreateFileMappingA
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetDiskFreeSpaceA
FreeLibrary
LoadLibraryA
GetProcAddress
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
WriteFile
CreateFileA
ReadFile
SetFilePointer
CloseHandle
GetTickCount
VirtualProtect

user32

GetClassNameA
DefWindowProcA
TranslateMessage
GetWindowTextA
GetWindowLongA
EnumChildWindows
IsWindowVisible
FindWindowExA
GetParent
wsprintfA
GetWindowTextLengthA
GetWindowRect
SetFocus
RegisterWindowMessageA
DestroyWindow
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
KillTimer
SetTimer
IsWindow
EnumWindows
UnregisterClassA
DispatchMessageA
PostThreadMessageA
IsZoomed
SendMessageTimeoutA
MapVirtualKeyA
GetKeyState
GetForegroundWindow
GetFocus
GetKeyboardLayoutNameA
CallNextHookEx
UnhookWindowsHookEx
GetCursorPos
CallWindowProcA
RemovePropA
SetPropA
GetPropA
SetWindowLongA
GetWindow
IsWindowEnabled
SendMessageA
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
PostMessageA
SetThreadDesktop
GetThreadDesktop
GetUserObjectInformationA
CloseDesktop
LoadStringA
wsprintfW
GetWindowThreadProcessId

gdi32

GetStockObject
TranslateCharsetInfo
GetDeviceCaps

advapi32

RegCloseKey
SetSecurityDescriptorDacl
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
InitializeSecurityDescriptor

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
StringFromCLSID
CoUninitialize
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantChangeType
VariantCopy
SafeArrayUnaccessData
LoadRegTypeLi
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SysAllocStringLen
SysFreeString
GetErrorInfo
SysStringLen

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

mpr

WNetGetConnectionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
IAlloc

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39c9b0c85d619aafaa6ad22de2fd0ef1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

version

mpr

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.data Size: 124KB - Virtual size: 123KB

.shared Size: 4KB - Virtual size: 876B

.reloc Size: 40KB - Virtual size: 36KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 124KB - Virtual size: 123KB

.shared
Size: 4KB - Virtual size: 876B

.reloc
Size: 40KB - Virtual size: 36KB