8878d9298a97ba734c97827f7e1023a6f4cc953e2933c6ed7e4553346ba6b64f

Sharing

Copy URL Twitter E-mail

General

Target

8878d9298a97ba734c97827f7e1023a6f4cc953e2933c6ed7e4553346ba6b64f
Size

1.6MB
MD5

85341b4fa49ef4e5ab0df6c30bf5e732
SHA1

98712ebb92d8582cb3ba26299a6e0ca43a52d982
SHA256

8878d9298a97ba734c97827f7e1023a6f4cc953e2933c6ed7e4553346ba6b64f
SHA512

3bb17d32258dc8d265a6f690a0b546b2613e1b96a54c3b04031b0310373fcd1a6d5ee2099810d2aae3b8c62a34c1e9adaa8dd77af6df52855e6d55ed6064f6c2
SSDEEP

49152:yqX8dD2su47GkbTrnLQTvDA/T48ZqrQBobse:y+SSNT8vZqU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8878d9298a97ba734c97827f7e1023a6f4cc953e2933c6ed7e4553346ba6b64f

Files

8878d9298a97ba734c97827f7e1023a6f4cc953e2933c6ed7e4553346ba6b64f
.dll windows:6 windows x86 arch:x86

d9cce9cac67215391da3d888c5137316

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

pidgenx.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
memmove
memcpy
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsicmp
_purecall
_vsnwprintf
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
wcsstr
wcschr
memset

kernel32

InterlockedExchangeAdd
CreateEventW
CreateSemaphoreW
VirtualQuery
ReleaseSemaphore
SetEvent
WaitForSingleObject
GetModuleFileNameW
GetCurrentThread
GetThreadPriority
GetProcessAffinityMask
RaiseException
UnmapViewOfFile
GetSystemInfo
VirtualProtect
FreeLibrary
LoadLibraryW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibraryAndExitThread
VirtualFree
VirtualAlloc
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
LocalFree
CloseHandle
GetLastError
GetVersionExA
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetLastError
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetVersion
SetThreadPriority
WaitForMultipleObjects
CreateThread
MapViewOfFile
CreateFileMappingW
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter

advapi32

TraceEvent
CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptGenRandom
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
CryptReleaseContext

rpcrt4

UuidToStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidFromStringW

Exports

Exports

PidGenX
PidGenX2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 380KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9cce9cac67215391da3d888c5137316

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 160KB - Virtual size: 159KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 380KB - Virtual size: 380KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 160KB - Virtual size: 159KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 380KB - Virtual size: 380KB