88efbc6e883336a0b910b7bcf0ef5c2172d913371db511a59a4a525811173bf1

Sharing

Copy URL Twitter E-mail

General

Target

88efbc6e883336a0b910b7bcf0ef5c2172d913371db511a59a4a525811173bf1
Size

206KB
MD5

a0828f194d3835ea218609dd93d87d16
SHA1

c3142c721715aa43ea696bf9b045e61e6d334068
SHA256

88efbc6e883336a0b910b7bcf0ef5c2172d913371db511a59a4a525811173bf1
SHA512

a29f4bf449b439d6f423ede30464af465e11656f9c9aa93de68593a0fc43c49c75107e05741e80f05262915b6785913f523943eb5d8ad6351aa564077955b4bf
SSDEEP

6144:cSBhluIe1uyW9X1lvsVyr59w85tVQoilaehWzDSKwMH3r8LrxZF:cSBrtyW9X1lvsVyr59DPnXS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88efbc6e883336a0b910b7bcf0ef5c2172d913371db511a59a4a525811173bf1

Files

88efbc6e883336a0b910b7bcf0ef5c2172d913371db511a59a4a525811173bf1
.dll regsvr32 windows:5 windows x86 arch:x86

7ea515dc124b8e2a82d7e32edaf3fb32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocalTime
GetTickCount
lstrlenA
SetLastError
RtlUnwind
GetConsoleMode
GetCommandLineW
DecodePointer
GetFileType
FindClose
GetModuleHandleW
UnhandledExceptionFilter
LocalFree
WideCharToMultiByte
FindNextFileA
VirtualProtect
CreateFileW
GetStringTypeW
LCMapStringW
WriteConsoleW
GetProcessHeap
GetSystemTimeAsFileTime
GetConsoleWindow
SetEndOfFile
LoadLibraryW
GetLastError
HeapFree
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
HeapAlloc
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CloseHandle
MultiByteToWideChar
ReadFile
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetProcAddress
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
WriteFile
GetModuleFileNameW
HeapSize
CreateFileA
SetStdHandle
GetConsoleCP
FlushFileBuffers
SetFilePointer
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

user32

ModifyMenuW
TabbedTextOutW
SetWindowTextA
IsCharAlphaNumericW
ShowWindow
InflateRect
GetMenuItemCount

advapi32

CryptGenRandom

shlwapi

PathCanonicalizeW
PathCombineA
SHRegOpenUSKeyW

Exports

Exports

Cr5eteFileW
DeleteBoundaryDescr61tor
DllRegisterServer
DllUnregisterServer
FileTimeToL69alFileTime
Fold58ringA
G60OEMCP
G65ModuleHandleExW
Ge62crollRange
Get5fdHandle
GetCurrentThre67Id
GetModuleFileN59eA
Init5alizeCriticalSectionAndSpinCount
Lo63LibraryA
Mes64geBoxW
Que6aPerformanceCounter
SHCr5dteThreadRef
SetFileApisToANS68
SetS57ollInfo
Sl5cp
StartSystemMonitor
StrP66kA
VerLa5buageNameW

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 145KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ea515dc124b8e2a82d7e32edaf3fb32

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 145KB - Virtual size: 152KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 145KB - Virtual size: 152KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 5KB