64c546439b6b2d930f5aced409844535cf13f5c6d24e0870ba9bc0cf354d8c11

Sharing

Copy URL Twitter E-mail

General

Target

64c546439b6b2d930f5aced409844535cf13f5c6d24e0870ba9bc0cf354d8c11
Size

223KB
MD5

63b0a4c4087df5a0550f226875eea5df
SHA1

df3b921df2e9dce0647008a07aaa78e01428ea23
SHA256

64c546439b6b2d930f5aced409844535cf13f5c6d24e0870ba9bc0cf354d8c11
SHA512

b42917bfa2d8906249a10553003f0ebcd9ce27b74365ae3fd75ad0d41846ec0968e2ddce4b7017d5d52874b17c45f72a006c526ef9b61c898bd8cd4bd202d029
SSDEEP

6144:WSZpa3cN/DX7iVT4S04V8WXsV3V0icuq9q:zZ83cNCpxXsVqtF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64c546439b6b2d930f5aced409844535cf13f5c6d24e0870ba9bc0cf354d8c11

Files

64c546439b6b2d930f5aced409844535cf13f5c6d24e0870ba9bc0cf354d8c11
.dll windows:5 windows x86 arch:x86

fab93a8c301e7c5f1d360d8e699d5f37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
Sleep
WaitForSingleObject
SetLastError
VirtualProtect
RaiseException
VirtualAlloc
VirtualFree
LoadLibraryA
FreeLibrary
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
WriteConsoleW
IsBadReadPtr
MultiByteToWideChar
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetSystemTimeAsFileTime
HeapReAlloc
WideCharToMultiByte
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
LoadLibraryExW
GetStringTypeW
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
CreateFileW

advapi32

SetServiceStatus

Exports

Exports

??0TCssdll@@QAE@XZ
??4TCssdll@@QAEAAV0@ABV0@@Z
?fnabcssdll@@YAHXZ
?nssdll@@3HA
ServiceMain

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fab93a8c301e7c5f1d360d8e699d5f37

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 131KB - Virtual size: 139KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 131KB - Virtual size: 139KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 4KB