20590c554f441218e4731a89e88d048a1c144cadb6b464499e1097d7f88ff796

Sharing

Copy URL Twitter E-mail

General

Target

20590c554f441218e4731a89e88d048a1c144cadb6b464499e1097d7f88ff796
Size

27KB
MD5

18799d84fd010c0f1c0b839a3a1c64a7
SHA1

5b8d5a028a5cae28c3f8a5bded69ee9563e9eee7
SHA256

20590c554f441218e4731a89e88d048a1c144cadb6b464499e1097d7f88ff796
SHA512

04debf00a0bdafece08c2ea6b0972291285d1edd4aa8b779d862b93c77300c8723d84d315dd7f50b4cbef3da18812ff8da835124c700f55e3b4db410747416a9
SSDEEP

384:G7ligfC7pNQmD88akkBtYwjPsEsJ/hC+mOPDVuPTu+S5NyHyk17icY0SdaXr:ClfC48X/h2OLVuPK3/ySk17icY/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20590c554f441218e4731a89e88d048a1c144cadb6b464499e1097d7f88ff796

Files

20590c554f441218e4731a89e88d048a1c144cadb6b464499e1097d7f88ff796
.dll windows:4 windows x86 arch:x86

a9655d10305ec1e86a31df75e27df066

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsA
Sleep
GetModuleFileNameA
ExitProcess
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetFileTime
GetSystemDirectoryA
MoveFileA
DuplicateHandle
OpenProcess
FreeLibrary
GetProcAddress
SetFileTime
TerminateProcess
WriteFile
DisconnectNamedPipe
WriteProfileStringA
CreateProcessA
CreatePipe
Process32Next
Process32First
CreateToolhelp32Snapshot
PeekNamedPipe
SetFilePointer
WaitForSingleObject
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
GetProfileStringA
CopyFileA
CreateEventA
WaitForMultipleObjects
CreateFileA
GetFileSize
ReadFile
GetCurrentProcess
LeaveCriticalSection
GetLastError
GetTempPathA
CloseHandle
InitializeCriticalSection
GetLocalTime
DeleteFileA
LoadLibraryA

advapi32

RegCloseKey
OpenEventLogA
GetOldestEventLogRecord
ReadEventLogA
CloseEventLog
RegOpenKeyExA
RegSetValueExA
RegNotifyChangeKeyValue
RegCreateKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

ws2_32

recv
send
select
socket
inet_addr
htons
gethostbyname
connect
WSAStartup
shutdown
WSAGetLastError
closesocket

msvcrt

__CxxFrameHandler
_fileno
_filelength
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
malloc
free
_CxxThrowException
_purecall
fclose
fwrite
sprintf
fopen
_vsnprintf
??2@YAPAXI@Z
_beginthreadex
atoi
strrchr
??3@YAXPAX@Z
localtime
strstr
_strlwr
_access
strncpy
rand
srand
time
fread
ftell
fseek
fgets
_iob

iphlpapi

GetAdaptersInfo

Exports

Exports

MyStart

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9655d10305ec1e86a31df75e27df066

Headers

File Characteristics

Imports

kernel32

advapi32

ws2_32

msvcrt

iphlpapi

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 2KB