f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0

Sharing

Copy URL

Twitter E-mail

General

Target

f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0
Size

184KB
MD5

d0fe27865ab271963e27973e81b77bae
SHA1

a5796a2cc31e1ab1a8a12131f803affe735a835f
SHA256

f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0
SHA512

92dbedebb6a02ad1d0935ea12f502074ed822cadf410e56a7adbf7e5be91aa84eb053fc87c0812aa176a0f893cfdecf5738f7f591e8f096a2cc6c6724ff0feee
SSDEEP

3072:lkpTnY21vDE9rZVan6kyHrTqBai3oRu0zPgTQ7dL6HtdJkkQVEypc94tG+c6ThN:lSTnY21w9rZk6kyHiBb8LzPgTFy/c6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0

Files

f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0
.dll windows:6 windows x64 arch:x64

640ef767b60cd41dc392cf589951748c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreatePipe
GetStartupInfoW
CreateProcessW
PeekNamedPipe
WaitForSingleObject
WriteFile
GetLastError
SetFilePointer
DeleteFileW
WideCharToMultiByte
MultiByteToWideChar
ReadFile
GetFileSize
CloseHandle
CreateFileW
Sleep
FreeConsole
HeapFree
GetProcessHeap
GetTempFileNameW
HeapAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
LCMapStringW
GetStdHandle
GetFileType
GetACP
HeapReAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
HeapSize
SetFilePointerEx
WriteConsoleW
EncodePointer

user32

wsprintfW

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerW

httpapi

HttpRemoveUrl
HttpReceiveHttpRequest
HttpCreateHttpHandle
HttpInitialize
HttpSendHttpResponse
HttpAddUrl
HttpTerminate
HttpReceiveRequestEntityBody

Exports

Exports

ServiceMain

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

640ef767b60cd41dc392cf589951748c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

httpapi

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 4KB - Virtual size: 8KB

.pdata Size: 6KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 216B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 6KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 216B

.reloc
Size: 2KB - Virtual size: 1KB