27e6e6aa7cb4c2e62a94218c58757caafff1b6b79fab8bb7062ad281aa92c0d4

Sharing

Copy URL Twitter E-mail

General

Target

27e6e6aa7cb4c2e62a94218c58757caafff1b6b79fab8bb7062ad281aa92c0d4
Size

259KB
MD5

5590c7e442e8d2bc857813c008ce4a6c
SHA1

eaf42470309dd193d2c5981618c8398e908d6f15
SHA256

27e6e6aa7cb4c2e62a94218c58757caafff1b6b79fab8bb7062ad281aa92c0d4
SHA512

f657a778a82c059191cc2b1fc00ce5f935e3ed85059100892999150e3f94e29ec2e8bec498cddb4f54a37bd810d4124003af0714c1218c1d4a1e67aa76e15adf
SSDEEP

6144:ks7Pz6MhtyuqCxevrwP4fJ8JIiI9NpD6+W3hYQw3z8:k0q04h8vIjpD6TM8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27e6e6aa7cb4c2e62a94218c58757caafff1b6b79fab8bb7062ad281aa92c0d4

Files

27e6e6aa7cb4c2e62a94218c58757caafff1b6b79fab8bb7062ad281aa92c0d4
.dll windows:6 windows x86 arch:x86

993e3fcbcab0ffdde9d950113c2f613b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
CloseHandle
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetLastError
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFullPathNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
AcquireSRWLockExclusive
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
GetCurrentProcessId
CreateNamedPipeW
SetThreadStackGuarantee
GetCurrentThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
DecodePointer
SetFilePointerEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

Exports

Exports

DllMain
WTSQueryUserToken

Sections

.text
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

993e3fcbcab0ffdde9d950113c2f613b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

bcrypt

Exports

Exports

Sections

.text Size: 199KB - Virtual size: 198KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 199KB - Virtual size: 198KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 9KB - Virtual size: 9KB