6cf78943728286d0bddd99049d81065673ab7f679029cdd5f5dc69f90197136e

Sharing

Copy URL Twitter E-mail

General

Target

6cf78943728286d0bddd99049d81065673ab7f679029cdd5f5dc69f90197136e
Size

56KB
MD5

c0568d6c0aa6d019454c9613b1a9b0ef
SHA1

1403241c415a8d686b1148fa4229a2eb833d8d08
SHA256

6cf78943728286d0bddd99049d81065673ab7f679029cdd5f5dc69f90197136e
SHA512

8e4a3c0c059c6244fbad542ff945fe82e75c8ce37bf758c8b9be419128ae8fea5c0585a19b4c3165ab188e0747f2ad1e09938ea5210cbb89b50e0e848dfc091c
SSDEEP

768:TLjkQICLc2A7quw9DLcZrigznrhazGcsfQ/5LXvOxLZpq8dE5AE2Fow:TLjkQIaIAD4ZvhnfQxLfO3m5AE27

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6cf78943728286d0bddd99049d81065673ab7f679029cdd5f5dc69f90197136e

Files

6cf78943728286d0bddd99049d81065673ab7f679029cdd5f5dc69f90197136e
.dll windows:5 windows x86 arch:x86

e7a8f1cbc717705d65734dc63e9751cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\FlowCloud\trunk\Dev\src\fcClient\Release\XXXModule_dlcore0.pdb

Imports

kernel32

ExitProcess
GetFileSize
GetModuleHandleW
ReadFile
GetModuleFileNameW
CreateFileW
VirtualAlloc
VirtualProtect
CloseHandle
GetCurrentProcess
VirtualFree
GetLastError
GetProcAddress
LoadLibraryA
LoadLibraryW
IsDebuggerPresent
CreateFileA
SetStdHandle
WriteConsoleW
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
RtlUnwind
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteFile
InitializeCriticalSectionAndSpinCount
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7a8f1cbc717705d65734dc63e9751cc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 5KB - Virtual size: 5KB