e0644961eb0c4a3876102ececd5a2ca5

Sharing

Copy URL Twitter E-mail

General

Target

e0644961eb0c4a3876102ececd5a2ca5
Size

72KB
MD5

e0644961eb0c4a3876102ececd5a2ca5
SHA1

6579fdd49bf4d19e8e654870f3e692ecd9afb3e2
SHA256

81a012b50a7281b4cf52f148aaf26fc3928d89463e240f54a57c5e2bdb4cf67b
SHA512

f1b74f70b37efe7f8048d8d41340c3a80dcea1ce7e0acd36d97f22ddf04b2649694abc9114cfb52d095022cea334821e8c7d21d14cd2ce895949c3c57efca86d
SSDEEP

1536:bf/tmm1QUyiG3rTeOX89BPo8gyrBzsoiooLq:rom1QUyZoBPjBooiooLq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0644961eb0c4a3876102ececd5a2ca5

Files

e0644961eb0c4a3876102ececd5a2ca5
.dll windows:4 windows x86 arch:x86

6d3489c714bab81a35a8b7dab8179600

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
WriteFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
CreateEventA
SetEvent
FreeConsole
SetUnhandledExceptionFilter
GetWindowsDirectoryA
GetCurrentProcessId
CreateFileA
SetFilePointer
ReadFile
GetSystemDirectoryA
GetTickCount
GetModuleHandleA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
OpenProcess
lstrlenA
Sleep
DeleteFileA
SetLastError
GetLastError
WaitForSingleObject
CloseHandle
lstrcatA
GetProcessHeap
HeapAlloc
SetEndOfFile
HeapFree
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetCPInfo
IsBadCodePtr
RtlUnwind
RaiseException
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TlsAlloc
TlsFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr

user32

wsprintfA
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
SetThreadDesktop

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey

wininet

InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
DeleteUrlCacheEntry

urlmon

URLDownloadToFileA

Exports

Exports

ServiceMain

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d3489c714bab81a35a8b7dab8179600

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

urlmon

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 25KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 25KB

.reloc
Size: 8KB - Virtual size: 4KB