6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7

Sharing

Copy URL

Twitter E-mail

General

Target

6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7
Size

597KB
MD5

37ea95f7fa8fb51446c18f9f3aa63df3
SHA1

246d49892298b850a8854b3bbdbbe516147f6fdd
SHA256

6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7
SHA512

3305bc222787e94778829228a488c2e8d5642702defafafa291fa6a218500fae8ef54ae5387c16084e0ebb36a9ee3eca5cd2cb3b94e879651afd521a58ec93c2
SSDEEP

12288:/NeFKFt0NM1Ai2rA8G7qC8rCO48C1+JUKlc58AgGMus6zNEhfTReSQD:/NeFKENMitcR7z8rh4hKlc5TgGMuRxKI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7

Files

6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7
.dll windows:4 windows x64 arch:x64

ae13c785410c27de4e29f7cf8d951653

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

gdi32

AddFontResourceA
AngleArc
Arc
ArcTo
BeginPath
Chord
CloseFigure
CombineRgn
CombineTransform
CreateBitmap
CreateDCA
CreateDCW
CreateICA
CreateICW
DeleteDC
DeleteEnhMetaFile
DeleteMetaFile
DeleteObject
EnumEnhMetaFile
EnumFontFamiliesA

iphlpapi

GetPerAdapterInfo
GetTcpStatistics
GetUdpStatistics
GetUdpTable
GetUniDirectionalAdapterInfo
IpReleaseAddress
IpRenewAddress
SetIfEntry
SetIpForwardEntry
SetIpNetEntry
SetIpStatistics

kernel32

CloseHandle
GetProcessHeap
GetProcessHeaps
HeapDestroy
HeapFree
VirtualAlloc
VirtualProtect

Exports

Exports

AlphaEvent
ArcAcl
ArcHardNet
BlockFloodClick
CallConsoleMessage
CheckPixelLineBitmapsFile
ChordCompatibleInformation
DeleteDateConnectionPosition
DrawFillBlink
HeapFromServerDacl
IntersectPtrChange
MakeRgnCountCaps
PaintFloodFileHeaderDevice
PieDi
Process32Profiles
RecvModuleEcho
ReportDi
ReportNet
ResetNetworkBrushRectHandle
ShellDlgExtent
ShowDialWindows
SubtractDeleteConnected
VerifyTcp
VirtualEventWith
WaveDateLowerPos

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 559KB - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1024B - Virtual size: 733B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ae13c785410c27de4e29f7cf8d951653

Headers

File Characteristics

Imports

gdi32

iphlpapi

kernel32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 559KB - Virtual size: 559KB

.pdata Size: 512B - Virtual size: 312B

.xdata Size: 512B - Virtual size: 308B

.edata Size: 1024B - Virtual size: 733B

.idata Size: 1KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 559KB - Virtual size: 559KB

.pdata
Size: 512B - Virtual size: 312B

.xdata
Size: 512B - Virtual size: 308B

.edata
Size: 1024B - Virtual size: 733B

.idata
Size: 1KB - Virtual size: 1KB