d74791c2b0d703d8f1a3e9cd23d508be

Sharing

Copy URL Twitter E-mail

General

Target

d74791c2b0d703d8f1a3e9cd23d508be
Size

111KB
MD5

d74791c2b0d703d8f1a3e9cd23d508be
SHA1

73062750f6e88dc12bbb4b56b28c488f85746eb5
SHA256

d9a2cdbbe567e8f49fef2e75dd0d2bee66cb617968b666955d813f9d959a384e
SHA512

427ee0b0a7db9be2546b7a5bd0136c98c8d63ae35c004924b70ec92fabef594d2fcd9203183358cc5c7c037c4fd38ff35db6884cd7be42f04bae1d8ab3c5e9a5
SSDEEP

3072:rMjUmz4PE9RYKgceOOl5k6VdrTDL2HPDdSVAl1lnFNz:IUmz0BKgcebkuDEPB7l1J7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d74791c2b0d703d8f1a3e9cd23d508be

Files

d74791c2b0d703d8f1a3e9cd23d508be
.dll windows:4 windows x86 arch:x86

321a136d297b349ed2962d612b8dc686

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_beginthreadex
wcstombs
realloc
strncat
wcscpy
_errno
strncmp
_snprintf
atoi
strncpy
strrchr
strcat
_except_handler3
calloc
strcmp
strcpy
malloc
strchr
memcmp
??2@YAPAXI@Z
memset
__CxxFrameHandler
strstr
strlen
_ftol
ceil
memmove
memcpy
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
free
_strcmpi
_strupr
_strnicmp
_strrev
_strnset
??3@YAXPAX@Z

kernel32

CreateFileA
GetCurrentThreadId
lstrcmpiA
LocalSize
FreeConsole
SetUnhandledExceptionFilter
CreateMutexA
SetErrorMode
OpenEventA
GetSystemInfo
GlobalMemoryStatusEx
OutputDebugStringA
PeekNamedPipe
TerminateProcess
CreatePipe
CreateProcessA
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
WaitForSingleObject
GetFileAttributesA
GetTickCount
MoveFileA
MoveFileExA
CreateEventA
TerminateThread
CreateToolhelp32Snapshot
Process32First
Process32Next
GetLocalTime
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetDriveTypeA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
RaiseException
ReadFile
SetFilePointer
WriteFile
Sleep
GetModuleFileNameA
SetLastError
GetSystemDirectoryA
ExitProcess
GetCurrentProcess
GetVersion
DeviceIoControl
CreateThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

msvfw32

ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame
ICCompressorFree

Exports

Exports

Eternal
Go
Heart
On
ServiceMain

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

321a136d297b349ed2962d612b8dc686

Headers

File Characteristics

Imports

msvcrt

kernel32

msvcp60

msvfw32

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 100KB

PAGE1 Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 101KB - Virtual size: 100KB

PAGE1
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 6KB - Virtual size: 6KB