cb64c0068642fdef94ab1598ccacb532

Sharing

Copy URL Twitter E-mail

General

Target

cb64c0068642fdef94ab1598ccacb532
Size

29KB
MD5

cb64c0068642fdef94ab1598ccacb532
SHA1

93c83d70375d293811ffe7f66f69b2644a29d0dc
SHA256

774e2b69d2d4062c62451c5eef96826a9e450d1864a5c489900b6663c14f761a
SHA512

ea1e2dab1801c03913437fb20c1d0096c9cb1f78a689e4dead097fcd641b0b6de3e8f1e36f397368eb3954c4015976e3c17a6003b0a70c2520a49d77f32366bb
SSDEEP

384:JJ42DjJxZMXSjyIS0YYEYqqRELhTWg4K+KWEcxrzrW6WW0gL:JtBuN0YYDELSzjEMrzJP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb64c0068642fdef94ab1598ccacb532

Files

cb64c0068642fdef94ab1598ccacb532
.dll windows:4 windows x86 arch:x86

17390e48654cd11c641ea30919b83dea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CopyFileA
CloseHandle
lstrlenW
lstrlenA
lstrcpynA
lstrcpyW
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WriteFile
WinExec
WideCharToMultiByte
VirtualProtect
TerminateThread
Sleep
SetFilePointer
ReadFile
MultiByteToWideChar
LocalFree
LocalAlloc
LoadLibraryA
IsBadWritePtr
IsBadReadPtr
GlobalFree
GlobalAlloc
GetVersionExA
GetTickCount
GetTempPathA
GetTempFileNameA
GetSystemDirectoryA
GetProcAddress
GetModuleFileNameA
GetFileSize
GetCurrentProcessId
GetCurrentProcess
GetCommandLineA
FindAtomA
CreateFileA
CreateProcessA
CreateThread
DeleteAtom
DeleteFileA
ExitProcess
ExitThread
AddAtomA

ole32

CreateStreamOnHGlobal

gdi32

CreateBitmap
SetBkMode
SetBkColor
SelectObject
GetObjectA
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontA
CreateCompatibleDC
BitBlt

advapi32

AdjustTokenPrivileges
RegSetValueExA
RegOpenKeyExA
RegFlushKey
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

user32

GetDesktopWindow
GetForegroundWindow
GetWindowDC
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
IsWindow
IsWindowVisible
OpenClipboard
ReleaseDC
GetClipboardData
SetWindowLongA
keybd_event
GetClientRect
GetClassNameA
CloseClipboard
CreateWindowExA
DrawTextA
EnumChildWindows
EnumWindows
ExitWindowsEx
SendMessageA
FillRect

wininet

InternetReadFile
InternetOpenA
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA

shlwapi

PathIsDirectoryA

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertGetNameStringA
CertOpenStore
CertOpenSystemStoreA
PFXExportCertStoreEx
CertAddCertificateContextToStore

Exports

Exports

s

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17390e48654cd11c641ea30919b83dea

Headers

File Characteristics

Imports

kernel32

ole32

gdi32

advapi32

user32

wininet

shlwapi

crypt32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: - Virtual size: 116KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: - Virtual size: 116KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 2KB - Virtual size: 2KB