906cf2ecbf29b4b66210a8b64eec57cf3b1e65147096d5c2856f43178fcd345c

Sharing

Copy URL

Twitter E-mail

General

Target

906cf2ecbf29b4b66210a8b64eec57cf3b1e65147096d5c2856f43178fcd345c
Size

71KB
MD5

002c4a037d21c1a7d09869a3a8dc3719
SHA1

eafd4fa78ea2ad731685f42bfa78704affb12836
SHA256

906cf2ecbf29b4b66210a8b64eec57cf3b1e65147096d5c2856f43178fcd345c
SHA512

316fdca9e96fdd0ca8335c319cebabab20e52bdf271b22c530d5a467a5c64765a23913a70a24f67f189a9890c610e635d849987b0d3ddf7cb5583d8a5c2052f1
SSDEEP

1536:dHjSed1ssIbteetsQT/2O5qlIRuaMP86oajesOO2r:lOKs/AcKMidSsORr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
906cf2ecbf29b4b66210a8b64eec57cf3b1e65147096d5c2856f43178fcd345c

Files

906cf2ecbf29b4b66210a8b64eec57cf3b1e65147096d5c2856f43178fcd345c
.dll windows:4 windows x86 arch:x86

65ab8312656177202b4410ce3a5cdbb1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegCloseKey
RegSetValueExA
RegOpenKeyExA
CloseEventLog
ReadEventLogA
GetOldestEventLogRecord
OpenEventLogA

ws2_32

closesocket
WSAGetLastError
send
recv
select
socket
inet_addr
htons
gethostbyname
connect
WSAStartup
shutdown

iphlpapi

GetAdaptersInfo

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
CloseHandle
GetLastError
GetCurrentProcess
ReadFile
GetFileSize
CreateFileA
WaitForMultipleObjects
CreateEventA
Sleep
GetProfileStringA
SetFileTime
SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsA
GetModuleFileNameA
LeaveCriticalSection
GetLocalTime
EnterCriticalSection
InitializeCriticalSection
ExitProcess
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetFileTime
GetSystemDirectoryA
MoveFileA
DeleteFileA
DuplicateHandle
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
TerminateProcess
WriteFile
DisconnectNamedPipe
WriteProfileStringA
CreateProcessA
CreatePipe
Process32Next
Process32First
CreateToolhelp32Snapshot
PeekNamedPipe
SetFilePointer
WaitForSingleObject
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
RtlUnwind
GetFileAttributesA
GetTimeZoneInformation
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
TlsAlloc
TlsFree
SetLastError
TlsGetValue
UnhandledExceptionFilter
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP

Exports

Exports

MyStart

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65ab8312656177202b4410ce3a5cdbb1

Headers

File Characteristics

Imports

advapi32

ws2_32

iphlpapi

kernel32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 5KB - Virtual size: 14KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 5KB - Virtual size: 14KB

.reloc
Size: 5KB - Virtual size: 5KB