645ee3601aea4c1af8b938f64698bf6c5978b1151aef53e183bb768791c927e2

Sharing

Copy URL

Twitter E-mail

General

Target

645ee3601aea4c1af8b938f64698bf6c5978b1151aef53e183bb768791c927e2
Size

55KB
MD5

af2eee830dfa7be65f113643f86b0c54
SHA1

f1a3b1cf26d2077b0350b444dacacc932f59e181
SHA256

645ee3601aea4c1af8b938f64698bf6c5978b1151aef53e183bb768791c927e2
SHA512

0138c44393617089ca93059995664a0f9c615760fefe55f7fa5ea9a7e31290fb7ff30429e6216fd4fde8710a8f453ae1858b27caa4925348a6b50769225716fc
SSDEEP

1536:mZhaaH0yF8y+Sj7GCp6IlHvw3KCyKYOr2VjmTI5ubZ:mTavaj7Xp6ItFmYawQI5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
645ee3601aea4c1af8b938f64698bf6c5978b1151aef53e183bb768791c927e2

Files

645ee3601aea4c1af8b938f64698bf6c5978b1151aef53e183bb768791c927e2
.dll windows:5 windows x64 arch:x64

1cb737677dd5670cdbbf492469557d95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegCreateKeyA
RegOpenKeyExA
SetServiceStatus
RegCloseKey
RegisterServiceCtrlHandlerA

kernel32

CreateFileA
GetFileSize
lstrlenA
WriteFile
Sleep
FreeConsole
ReadFile
GetProcAddress
LoadLibraryA
GetModuleFileNameA
CloseHandle
HeapAlloc
ExitThread
GetLastError
ResumeThread
CreateThread
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
ExitProcess
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
HeapFree
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers

Exports

Exports

ServiceMain

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 618B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cb737677dd5670cdbbf492469557d95

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 5KB - Virtual size: 13KB

.pdata Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 618B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 5KB - Virtual size: 13KB

.pdata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 618B