d5b8fc1de89fb7f8581556d31fe18aae

Sharing

Copy URL Twitter E-mail

General

Target

d5b8fc1de89fb7f8581556d31fe18aae
Size

111KB
MD5

d5b8fc1de89fb7f8581556d31fe18aae
SHA1

aed11948608d6890e5571fc1d0349e1dc4557b65
SHA256

0040bdeddc1c0d336ae1710887480a1233e3f22c9855cd84500d34187f442d6b
SHA512

0d3c7e88e675afec42f03e792e1cd3fc510eea55f10b18d4e55e4da7dabc28625ed8ca513bda142d7297f1bb7ee8e31af43ec992644a5626880c773fa1e52eda
SSDEEP

1536:oOKT/0s81AY+471+doZo6tJZpbiwD/AKkXsOzjpwUGRHHVgtneSGGbyGju2To7R:odws8eGt7rb91wmUGcmOxX+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5b8fc1de89fb7f8581556d31fe18aae

Files

d5b8fc1de89fb7f8581556d31fe18aae
.dll windows:4 windows x64 arch:x64

b4382d5939add12454906109af4cd60e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

nnienniate.pdb

Imports

kernel32

lstrcpyW
IsBadWritePtr
GetFileType
GetEnvironmentStrings
HeapDestroy
MultiByteToWideChar
FreeEnvironmentStringsW
RtlUnwind
UnmapViewOfFile
GetTickCount
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
ReleaseMutex
SetEvent
OpenProcess
GetACP
CreateNamedPipeA
GetEnvironmentStringsW
GetStartupInfoA
UnhandledExceptionFilter
CreateEventA
SetUnhandledExceptionFilter
VirtualQuery
GetModuleHandleA
WriteFile
GetOEMCP
VirtualProtect
CreateTimerQueueTimer
IsBadCodePtr
CreateMutexW
GetLastError
LoadLibraryA
GetLocaleInfoA
EnterCriticalSection
GetStdHandle
DuplicateHandle
CreateThread
WaitForSingleObject
DeleteCriticalSection
GetSystemInfo
HeapFree
lstrcatW
ResetEvent
InitializeCriticalSection
GetVersionExA
IsBadReadPtr
LCMapStringA
HeapAlloc
Sleep
WaitForMultipleObjects
ConnectNamedPipe
GetCurrentThreadId
SetLastError
LeaveCriticalSection
FreeEnvironmentStringsA
QueryPerformanceCounter
DisconnectNamedPipe
TerminateProcess
DeleteTimerQueueTimer
GetModuleFileNameA
GetCPInfo
LCMapStringW

user32

CreateIconFromResource
DrawIcon
wsprintfW
CheckMenuItem

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

msvcrt

exit
wcstok
free
scanf
swprintf
isdigit
wcschr
memmove
malloc
wcsncmp
fgetws
wcscat
fprintf
realloc
wcslen
wcscpy
memcpy
calloc
wprintf
strtok
wcstod
printf
wcscmp
_ltow
wcsstr
wcstol
towupper
memset
_strnicmp
vwprintf
fflush
_wcsnset
_wtoi
_stricmp

Exports

Exports

esbob

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xdata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4382d5939add12454906109af4cd60e

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcrt

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 68KB

.data Size: 33KB - Virtual size: 63KB

xdata Size: 1024B - Virtual size: 552B

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: 69KB - Virtual size: 68KB

.data
Size: 33KB - Virtual size: 63KB

xdata
Size: 1024B - Virtual size: 552B

.rsrc
Size: 6KB - Virtual size: 6KB