e159e8ed539b716fc54d33f10cb0c19a

Sharing

Copy URL Twitter E-mail

General

Target

e159e8ed539b716fc54d33f10cb0c19a
Size

389KB
MD5

e159e8ed539b716fc54d33f10cb0c19a
SHA1

bf414423a53bf785754b56a8d100267d29281742
SHA256

4f97d4fae17e39314c3931c86bb4373c6cc8127565f906de787eded826c78293
SHA512

673197123c3e7da8f908e5f9a029a4d781c795205e16e2b8fb712a5bdd1186f93c0c2849877ab8ac3e9cac6cf9838a260973dc4b472591af96d19f6577c004a7
SSDEEP

6144:b5AXRP753YgelVy7pE7rBVb3OvvVuI1pjczdy5yl/f0oopcEuZ+ep:FAnEuOzsvFTcd/fkS8ep

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e159e8ed539b716fc54d33f10cb0c19a

Files

e159e8ed539b716fc54d33f10cb0c19a
.dll windows:4 windows x86 arch:x86

e4d010c7fdb0254fdda53cb146c0bee6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

realloc
rand
puts
printf
memset
memcpy
malloc
isspace
isdigit
getenv
fseek
free
fprintf
srand
fgets
fclose
exit
atoi
_vsnprintf
_stricmp
_msize
_ismbblead
_iob
_initterm
_exit
_errno
_controlfp
_cexit
_amsg_exit
__setusermatherr
__set_app_type
strchr
strncmp
strrchr
strstr
time
tolower
fopen
__p__fmode
__p__commode
__getmainargs
_XcptFilter

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

WriteFile
VirtualAlloc
UnmapViewOfFile
UnhandledExceptionFilter
TerminateProcess
Sleep
SetUnhandledExceptionFilter
SetLastError
SetFilePointer
SetFileAttributesA
SetErrorMode
SetEndOfFile
SetCurrentDirectoryA
RtlUnwind
RemoveDirectoryA
ReadFile
QueryPerformanceCounter
OutputDebugStringA
OpenProcess
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
InterlockedExchange
InterlockedCompareExchange
HeapFree
HeapAlloc
GetTickCount
GetTempPathA
GetTempFileNameA
GetSystemTimeAsFileTime
GetProcessPriorityBoost
GetProcessHeap
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionA
GetModuleHandleA
GetLastError
GetFullPathNameA
GetFileSize
GetFileInformationByHandle
GetFileAttributesExA
CloseHandle
CopyFileA
CreateFileA
CreateFileMappingA
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindFirstFileExA
FindNextFileA
FlushViewOfFile
FreeLibrary
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA

dbghelp

SymSetSearchPath
SymSetOptions
SymRegisterCallback64
SymInitialize
SymFindFileInPath
SymCleanup
MakeSureDirectoryPathExists

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

Exports

Exports

CaptureStop
ConcatenateMeshes
GetDefaultJ2KOptions
GetNextRow
PlaneNormalize
SetJ2KOptions

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4d010c7fdb0254fdda53cb146c0bee6

Headers

File Characteristics

Imports

msvcrt

version

kernel32

dbghelp

advapi32

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 78KB

.rdata Size: 171KB - Virtual size: 171KB

.data Size: 69KB - Virtual size: 70KB

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 79KB - Virtual size: 78KB

.rdata
Size: 171KB - Virtual size: 171KB

.data
Size: 69KB - Virtual size: 70KB

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 5KB - Virtual size: 4KB