89e4090acbe74b3d72d47f9c3f11d39a9d724c35039e236a027758d9f122c0f1

Sharing

Copy URL

Twitter E-mail

General

Target

89e4090acbe74b3d72d47f9c3f11d39a9d724c35039e236a027758d9f122c0f1
Size

2.9MB
MD5

801c05e40ffe47490ec22174eca88dea
SHA1

b798afc06ae562b94eb2eb875fa3012b76043a7d
SHA256

89e4090acbe74b3d72d47f9c3f11d39a9d724c35039e236a027758d9f122c0f1
SHA512

a62a3b95236efb1a639a01716a9c93934dde66f2da1053e8d5a7a4feae1b42e8b1fa65ede4f7cbd6de574b8ae95d84dce0c1d4feac5a04d16fca3eecaaa35f31
SSDEEP

49152:Z2KnC1GsyhjbGD4FfjVB3fW2b36KPlUmI/v0yTeMOa6v6w:7nASGD4Ffj7W2bJI3ri

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89e4090acbe74b3d72d47f9c3f11d39a9d724c35039e236a027758d9f122c0f1

Files

89e4090acbe74b3d72d47f9c3f11d39a9d724c35039e236a027758d9f122c0f1
.dll windows:5 windows x86 arch:x86

21f7e9a7ee374dd83579d17b1a11617f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsW

advapi32

GetTokenInformation

lz32

LZSeek
LZClose

kernel32

CompareStringA
GetTimeZoneInformation
GetSystemTimeAsFileTime
CompareStringW
UnhandledExceptionFilter
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
EnterCriticalSection
Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetLastError
HeapFree
ExitProcess
FatalAppExitA
HeapAlloc
HeapReAlloc
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
SetEnvironmentVariableA
InterlockedDecrement
GetCurrentThread
RtlUnwind
InitializeCriticalSectionAndSpinCount
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
GetCommandLineA
GetLocaleInfoW
GetLocaleInfoA
CreateFileA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA

iphlpapi

Icmp6CreateFile

rasapi32

RasGetErrorStringA

oleaut32

GetRecordInfoFromGuids

user32

UnregisterHotKey

Exports

Exports

OsTlhtlohe

Sections

.text
Size: 784KB - Virtual size: 782KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 616KB - Virtual size: 614KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CONST
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21f7e9a7ee374dd83579d17b1a11617f

Headers

File Characteristics

Imports

setupapi

advapi32

lz32

kernel32

iphlpapi

rasapi32

oleaut32

user32

Exports

Exports

Sections

.text Size: 784KB - Virtual size: 782KB

.rdata Size: 616KB - Virtual size: 614KB

.data Size: 24KB - Virtual size: 28KB

CONST Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 56KB - Virtual size: 55KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 784KB - Virtual size: 782KB

.rdata
Size: 616KB - Virtual size: 614KB

.data
Size: 24KB - Virtual size: 28KB

CONST
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 56KB - Virtual size: 55KB

.reloc
Size: 16KB - Virtual size: 15KB