8644deb557e0a304b1e895ff1c3ad0400d06bca11f42c9493cfc70119e11c075

Sharing

Copy URL Twitter E-mail

General

Target

8644deb557e0a304b1e895ff1c3ad0400d06bca11f42c9493cfc70119e11c075
Size

103KB
MD5

60b845a2960058065f5f43aedf1a7289
SHA1

a6916524b122669b180864036aa1e375b9ad52ac
SHA256

8644deb557e0a304b1e895ff1c3ad0400d06bca11f42c9493cfc70119e11c075
SHA512

9c11ac11763cb4b575ca087ef1224d41530b08fec981b86fdc38a9d844bc6bf58dbf9ac3d67727b9316a06708c24b1478aac9486f378799c30b5da9a0014a306
SSDEEP

3072:usi6E5SjxGb3mPpksqo7cSxtTBfC4cSiPU:Q6QrpoBtTBg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8644deb557e0a304b1e895ff1c3ad0400d06bca11f42c9493cfc70119e11c075

Files

8644deb557e0a304b1e895ff1c3ad0400d06bca11f42c9493cfc70119e11c075
.dll windows:4 windows x86 arch:x86

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetSystemDefaultLangID
GetVersionExA
GetCurrentProcessId
GetSystemDirectoryA
TerminateProcess
GetHandleInformation
SetFileTime
GetFileTime
GetFileSize
CreateProcessA
LeaveCriticalSection
WriteFile
DisconnectNamedPipe
CreatePipe
WaitForMultipleObjects
ReadFile
PeekNamedPipe
FreeLibrary
SetFilePointer
GlobalFree
FlushFileBuffers
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
DeleteCriticalSection
LoadLibraryA
GetProcAddress
InitializeCriticalSection
GetLocalTime
OpenProcess
CreateFileA
GetCurrentProcess
DuplicateHandle
CloseHandle
DeleteFileA
ExitProcess
GetModuleFileNameA
Sleep
WaitForSingleObject
FreeConsole
GlobalAlloc

user32

GetProcessWindowStation
GetThreadDesktop
GetDC
UpdateWindow
OpenWindowStationA
SetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
GetSystemMetrics
CloseWindowStation
CloseDesktop
PostQuitMessage
DefWindowProcA
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
ReleaseDC
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDCA
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
DeleteObject
SelectObject
GetStockObject

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
GetUserNameA

ws2_32

inet_ntoa
gethostbyname
gethostname
closesocket
shutdown
send
connect
htons
inet_addr
socket
recv
WSAStartup
select
setsockopt

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

shlwapi

SHGetValueA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strncmp
_vsnprintf
_iob
printf
strchr
sscanf
memcmp
strlen
memcpy
strcpy
rand
strcat
sprintf
_purecall
memset
??2@YAPAXI@Z
__CxxFrameHandler
fopen
fwrite
fclose
strstr
strncpy
wcstombs
_beginthreadex
srand
_strlwr

Exports

Exports

ServiceMain
Start

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

msvcp60

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB