3bd6ea8a7840aada36eace64564779aeb259ca56b4cdd7e5e35c5281d273a84b

Sharing

Copy URL Twitter E-mail

General

Target

3bd6ea8a7840aada36eace64564779aeb259ca56b4cdd7e5e35c5281d273a84b
Size

103KB
MD5

06f32d1e256a88462ad5bf15bed464a7
SHA1

0039fea9a4f92e24af2709893e56dd920ea80246
SHA256

3bd6ea8a7840aada36eace64564779aeb259ca56b4cdd7e5e35c5281d273a84b
SHA512

bdf3b8654d2c28e09da1717302dac1fbb772823f4896bfbf90ec45754b34ab9eeaa8f90fd81b6ea12019f79527c3a8317b1ff48247a89300ac3a1a548015e717
SSDEEP

3072:8gi9ksFhqP00Pphsqo7cSxtTBfC4cSiZw:GpUpoBtTBg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bd6ea8a7840aada36eace64564779aeb259ca56b4cdd7e5e35c5281d273a84b

Files

3bd6ea8a7840aada36eace64564779aeb259ca56b4cdd7e5e35c5281d273a84b
.dll windows:4 windows x86 arch:x86

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetSystemDefaultLangID
GetVersionExA
GetCurrentProcessId
GetSystemDirectoryA
TerminateProcess
GetHandleInformation
SetFileTime
GetFileTime
GetFileSize
CreateProcessA
LeaveCriticalSection
WriteFile
DisconnectNamedPipe
CreatePipe
WaitForMultipleObjects
ReadFile
PeekNamedPipe
FreeLibrary
SetFilePointer
GlobalFree
FlushFileBuffers
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
DeleteCriticalSection
LoadLibraryA
GetProcAddress
InitializeCriticalSection
GetLocalTime
OpenProcess
CreateFileA
GetCurrentProcess
DuplicateHandle
CloseHandle
DeleteFileA
ExitProcess
GetModuleFileNameA
Sleep
WaitForSingleObject
FreeConsole
GlobalAlloc

user32

GetProcessWindowStation
GetThreadDesktop
GetDC
UpdateWindow
OpenWindowStationA
SetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
GetSystemMetrics
CloseWindowStation
CloseDesktop
PostQuitMessage
DefWindowProcA
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
ReleaseDC
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDCA
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
DeleteObject
SelectObject
GetStockObject

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
GetUserNameA

ws2_32

inet_ntoa
gethostbyname
gethostname
closesocket
shutdown
send
connect
htons
inet_addr
socket
recv
WSAStartup
select
setsockopt

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

shlwapi

SHGetValueA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strncmp
_vsnprintf
_iob
printf
strchr
sscanf
memcmp
strlen
memcpy
strcpy
rand
strcat
sprintf
_purecall
memset
??2@YAPAXI@Z
__CxxFrameHandler
fopen
fwrite
fclose
strstr
strncpy
wcstombs
_beginthreadex
srand
_strlwr

Exports

Exports

ServiceMain
Start

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

msvcp60

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB