df881a18878baaa6a10902aa6b410d5e

Sharing

Copy URL Twitter E-mail

General

Target

df881a18878baaa6a10902aa6b410d5e
Size

33KB
MD5

df881a18878baaa6a10902aa6b410d5e
SHA1

14ca1ed68c1806527fd1eaa1987d13071c604271
SHA256

54a57dabc385f548d49ddd494cddabe74a78d42d6bdd7843d305d0ef5be9a809
SHA512

1abbc2bda6642f0105c280439be2fe2b66102bf93959f98f0352072eac4d54c86def859b7e34e2e957ec9874ab225be2959ebdae63262d53238c37eb098e110f
SSDEEP

768:byxT/NwyvfaEPTrGp59LmserH8DZHfPFO:bazN/fHijnZVO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df881a18878baaa6a10902aa6b410d5e

Files

df881a18878baaa6a10902aa6b410d5e
.dll windows:4 windows x86 arch:x86

87ddb4164b0d226d62999f4074f7b2d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetLastError
CreateMutexA
GetCurrentProcessId
DeleteFileA
ReadFile
GetTempPathA
VirtualAlloc
GetPrivateProfileStringA
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
IsBadReadPtr
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
OpenProcess
WriteProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateThread
CreateThread
LoadLibraryA
GetProcAddress
ReadProcessMemory
VirtualProtect
GetModuleHandleA
GetCurrentProcess
TerminateProcess
CreateFileA
WriteFile
CloseHandle
VirtualProtectEx
Sleep

user32

GetWindowTextA
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow

wininet

InternetReadFile
InternetCloseHandle

ws2_32

closesocket

msvcrt

_initterm
malloc
_strnicmp
_adjust_fdiv
_strupr
_stricmp
_strlwr
free
wcslen
strcmp
strcpy
sprintf
strlen
memcpy
memset
??2@YAPAXI@Z
strrchr
strcat
atoi
??3@YAXPAX@Z
strncpy
strchr
strstr
fclose
fread
fopen

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdt
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87ddb4164b0d226d62999f4074f7b2d2

Headers

File Characteristics

Imports

kernel32

user32

wininet

ws2_32

msvcrt

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

sdt Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

sdt
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 3KB