e04d9c905811ba6256634b02c54cc427

Sharing

Copy URL Twitter E-mail

General

Target

e04d9c905811ba6256634b02c54cc427
Size

63KB
MD5

e04d9c905811ba6256634b02c54cc427
SHA1

efe3c48ea7c0c4277949341a81ea85e5818a04bf
SHA256

8cb5a5a8d0b85e02f0877ebad7e837c8aa65dac3de17df3fc4744550bccb6480
SHA512

96caf54afc858f144f65fb64460bb51a2bd3ec97280766a2a0299862530dfa5b14e4b9f6f0acebea693734cfaa7e515af78974b688d17fda267f58923d8f93d1
SSDEEP

1536:YRDHRJn/0qOVc79jkSRJM1URNkFWEnWgKy6xevDY/UpxE:YZxR8quAkKyURKjKzunx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e04d9c905811ba6256634b02c54cc427

Files

e04d9c905811ba6256634b02c54cc427
.dll windows:5 windows x86 arch:x86

9844402bb686d268e18a203dd39d041b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mtxoplat

_Getctype
_Xbig
_Inf
_Strxfrm
_FExp
_LEps
_Strcoll
_Poly
_FEps
_Hugeval
_Toupper
_FXbig
_Denorm
_LPoly
_Dscale
_LExp
_Snan
_LNan
_FSnan
_LCosh
_FInf
_LSinh
_Sinh
_Rteps
_LRteps
_FDenorm
_FRteps
_Getcvt
_FDscale
_Stold
_Eps
_Nan
_Wcrtomb

kernel32

GetCommandLineA
WritePrivateProfileStringA
DeleteFileA
VirtualQuery
VirtualFree
MapViewOfFile
SetFileAttributesA
VirtualLock
SetThreadPriority
WaitForMultipleObjects
GlobalLock
GetTempPathA
OpenProcess
GetFileSize
GetModuleHandleA
GetCurrentProcessId
lstrcmpA
CreateFileMappingA
MulDiv
GetVersion
FindNextFileA
lstrcpyA
ResumeThread
WriteProcessMemory
CreateFileA
GlobalAlloc
CopyFileA
ReadFile
UnmapViewOfFile
LoadLibraryA
GetCurrentThread
GetProcAddress
FindFirstFileA
SetCurrentDirectoryA
TerminateProcess
WriteFile
CloseHandle
GetCurrentProcess
GetFileAttributesA
SetFilePointer
CreatePipe
GetStartupInfoA
FindClose
GetPrivateProfileStructA
VirtualAlloc
GlobalUnlock
lstrlenW
GetComputerNameA
VirtualUnlock

user32

wvsprintfA
OpenClipboard
GetCursorPos
LoadCursorA
SetWindowPos
ScreenToClient
SetTimer
CreatePopupMenu
SendDlgItemMessageA
SetWindowTextA
EndDialog
MessageBoxA
EnumClipboardFormats
FindWindowA
SetClipboardData
SetWindowLongA
GetClipboardData
SetClassLongA
GetWindowRect
SetForegroundWindow
GetAsyncKeyState
TrackPopupMenu
CharUpperA
DestroyIcon
DestroyCursor
KillTimer
GetClassInfoA
GetDlgItem
GetParent
GetActiveWindow
IsWindowEnabled
InvalidateRect
LoadIconA

imagehlp

ImageNtHeader
ImageRvaToVa
CheckSumMappedFile

advapi32

RegCloseKey
RegOpenKeyExA
LookupPrivilegeValueA
RegCreateKeyExA

msvcrt

strncmp
div
free
realloc
strstr
malloc
_except_handler3

comdlg32

GetSaveFileNameA

Exports

Exports

CreateProcessNotify
BuildADsParentPath
ApphelpUpdateCacheEntry
BuildADsPathFromParent
AllocADsStr
DllClientCleanup
ConvertSidToU2Trustee
SdbCloseApphelpInformation
rsvpnsta
AdsTypeToLdapTypeCopyGeneralizedTime
Component
DllClientStartup
GetDisplayName
FreeADsStr
ChangeSeparator
GetDomainDNSNameForDomain
GetPermLayers
ConvertSidToString
FreeADsMem

Sections

.text
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9844402bb686d268e18a203dd39d041b

Headers

File Characteristics

Imports

mtxoplat

kernel32

user32

imagehlp

advapi32

msvcrt

comdlg32

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 56KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 53KB - Virtual size: 56KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB