c3afcfabe2f45a9aa44930107bcd5c09edb1cdeb447c8f742b299ff0c75af5b1

Sharing

Copy URL Twitter E-mail

General

Target

c3afcfabe2f45a9aa44930107bcd5c09edb1cdeb447c8f742b299ff0c75af5b1
Size

103KB
MD5

dba2af4a266b4083b7b213e4d3b1901b
SHA1

ff0141e56d8684ab1c31fe4304e582a22cb79925
SHA256

c3afcfabe2f45a9aa44930107bcd5c09edb1cdeb447c8f742b299ff0c75af5b1
SHA512

85a009ce42271ade8458db89e60d9af9723aa0959f3cc89b019f87bc6154a67e16101266664d1ca6d661a6c3f318c3bf2d0c334802b4a2ed60ece6fb633e4971
SSDEEP

3072:1+iQL1bWNC3Pptsqo7cSxtTBfC4cSi+B:vQpoBtTBg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3afcfabe2f45a9aa44930107bcd5c09edb1cdeb447c8f742b299ff0c75af5b1

Files

c3afcfabe2f45a9aa44930107bcd5c09edb1cdeb447c8f742b299ff0c75af5b1
.dll windows:4 windows x86 arch:x86

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetSystemDefaultLangID
GetVersionExA
GetCurrentProcessId
GetSystemDirectoryA
TerminateProcess
GetHandleInformation
SetFileTime
GetFileTime
GetFileSize
CreateProcessA
LeaveCriticalSection
WriteFile
DisconnectNamedPipe
CreatePipe
WaitForMultipleObjects
ReadFile
PeekNamedPipe
FreeLibrary
SetFilePointer
GlobalFree
FlushFileBuffers
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
DeleteCriticalSection
LoadLibraryA
GetProcAddress
InitializeCriticalSection
GetLocalTime
OpenProcess
CreateFileA
GetCurrentProcess
DuplicateHandle
CloseHandle
DeleteFileA
ExitProcess
GetModuleFileNameA
Sleep
WaitForSingleObject
FreeConsole
GlobalAlloc

user32

GetProcessWindowStation
GetThreadDesktop
GetDC
UpdateWindow
OpenWindowStationA
SetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
GetSystemMetrics
CloseWindowStation
CloseDesktop
PostQuitMessage
DefWindowProcA
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
ReleaseDC
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDCA
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
DeleteObject
SelectObject
GetStockObject

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
GetUserNameA

ws2_32

inet_ntoa
gethostbyname
gethostname
closesocket
shutdown
send
connect
htons
inet_addr
socket
recv
WSAStartup
select
setsockopt

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

shlwapi

SHGetValueA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strncmp
_vsnprintf
_iob
printf
strchr
sscanf
memcmp
strlen
memcpy
strcpy
rand
strcat
sprintf
_purecall
memset
??2@YAPAXI@Z
__CxxFrameHandler
fopen
fwrite
fclose
strstr
strncpy
wcstombs
_beginthreadex
srand
_strlwr

Exports

Exports

ServiceMain
Start

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

msvcp60

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB