8a3712f74755da5b2f1c014d394b30454be840d561a5d45534bb2fcbdcba172d

Sharing

Copy URL Twitter E-mail

General

Target

8a3712f74755da5b2f1c014d394b30454be840d561a5d45534bb2fcbdcba172d
Size

216KB
MD5

2e11b8b30b6930308bcc005d6d9156b6
SHA1

fe2e7c663913e0744822d1469be0c3655d24178d
SHA256

8a3712f74755da5b2f1c014d394b30454be840d561a5d45534bb2fcbdcba172d
SHA512

6b16f94043b6be989c1960112c73baad6463b495a899ef0a3eaac257e430d7a87bb58da252162f9a6fdf6bc84f89c8f1e1a8fbdb18ca795d7ee52e62324c25a1
SSDEEP

3072:lLAFEC218WJx81NHW85Dx0HFMcufXnz9HB7YHSpbKGvu4Jcj9klI6eIB9n5VbhiK:lK2fx81Nr5Dzcc5HCCKGvncjuB9vU8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a3712f74755da5b2f1c014d394b30454be840d561a5d45534bb2fcbdcba172d

Files

8a3712f74755da5b2f1c014d394b30454be840d561a5d45534bb2fcbdcba172d
.dll windows:5 windows x86 arch:x86

96197e72496e42b66353e7e82c3f5782

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryA
WideCharToMultiByte
GlobalMemoryStatusEx
InterlockedCompareExchange64
InitializeCriticalSection
DeleteCriticalSection
SetFileAttributesA
LeaveCriticalSection
InterlockedIncrement
GetCurrentProcessId
GetDriveTypeA
TerminateProcess
GetCommandLineA
GetCurrentThreadId
EnterCriticalSection
GetLogicalDrives
VirtualQueryEx
VirtualProtectEx
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
ResumeThread
DeleteFileA
GetEnvironmentVariableA
CreateProcessA
ReadFile
FindNextFileA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
CreatePipe
MultiByteToWideChar
DuplicateHandle
GetModuleFileNameA
GetCurrentThread
OutputDebugStringA
InterlockedExchange
Sleep
IsBadReadPtr
GetVersionExA
GetSystemInfo
LocalFree
GlobalFree
CreateThread
WaitForSingleObject
GetSystemDirectoryA
GetTickCount
WriteFile
SetFilePointer
GetLastError
GetModuleHandleA
InterlockedDecrement
LoadLibraryA
FindClose
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
CreateFileA
DeviceIoControl
CloseHandle
GlobalAlloc
FindFirstFileA
InterlockedCompareExchange
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryExW
RtlUnwind
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
lstrlenA
SetEndOfFile
HeapReAlloc
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetStdHandle
ExitProcess
UnhandledExceptionFilter

user32

PostMessageA
GetSystemMetrics
SetUserObjectSecurity
SetProcessWindowStation
OpenWindowStationA
GetUserObjectInformationA
GetProcessWindowStation
CloseDesktop
CloseWindowStation
KillTimer
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
SetTimer
OpenDesktopA
GetUserObjectSecurity
CharLowerBuffA

advapi32

BuildExplicitAccessWithNameA
LogonUserA
RegCreateKeyExA
RegSetValueExA
StartServiceA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
GetNamedSecurityInfoA
LogonUserW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
CreateProcessWithTokenW
CreateProcessWithLogonW
LookupAccountNameA
AddAccessAllowedAce
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAce
CopySid
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetAclInformation
GetAce
IsValidSid
GetSecurityDescriptorDacl
GetFileSecurityA
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
LookupAccountSidA

ole32

CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

odbc32

ord41
ord43
ord11
ord18
ord13
ord27
ord4
ord36
ord9
ord31
ord24
ord75
ord39

opends60

ord41
ord42
ord26
ord40
ord25

ws2_32

WSASocketA
socket
closesocket
htons
inet_addr
connect
select
__WSAFDIsSet
recv
send
WSASetLastError
WSAStartup
WSAEventSelect
WSACleanup
shutdown
WSASendTo
WSASend
WSAAsyncGetHostByName
WSARecv
WSARecvFrom
WSAAccept
listen
bind
htonl
getsockname
WSAAsyncSelect
inet_ntoa
getpeername
WSAGetLastError
inet_ntop
WSAIoctl
gethostbyname
setsockopt
gethostname
ioctlsocket

wininet

InternetConnectA
InternetReadFile
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCrackUrlA
InternetOpenA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

GetStockObject

Exports

Exports

maggie

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96197e72496e42b66353e7e82c3f5782

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

odbc32

opends60

ws2_32

wininet

userenv

gdi32

Exports

Exports

Sections

.text Size: 159KB - Virtual size: 158KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 23KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 159KB - Virtual size: 158KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 23KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB