c3e596848fbc92f90c247ae0fc9289a20d37aadd0361a12797adee0d89059251

Sharing

Copy URL Twitter E-mail

General

Target

c3e596848fbc92f90c247ae0fc9289a20d37aadd0361a12797adee0d89059251
Size

27KB
MD5

2de85dbfabd7fcc88353c531de14714b
SHA1

1b516a61eddefaa670509b9c88b9f0bfe7bb48db
SHA256

c3e596848fbc92f90c247ae0fc9289a20d37aadd0361a12797adee0d89059251
SHA512

069ba91199d65c8373ba03891abb6141e4ddfe75525e9d3610173ec27b7fd455abb7ea51ad63c7e270c120b8e8f8f709565727ccbb0bd1987ed4926965b4345b
SSDEEP

384:G7ligfC7pNQmD88akkBtYwjPsEsJ/hC+mOPDVuPTu+S5NyHykl7icY0SdaXr:ClfC48X/h2OLVuPK3/ySkl7icY/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3e596848fbc92f90c247ae0fc9289a20d37aadd0361a12797adee0d89059251

Files

c3e596848fbc92f90c247ae0fc9289a20d37aadd0361a12797adee0d89059251
.dll windows:4 windows x86 arch:x86

a9655d10305ec1e86a31df75e27df066

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsA
Sleep
GetModuleFileNameA
ExitProcess
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetFileTime
GetSystemDirectoryA
MoveFileA
DuplicateHandle
OpenProcess
FreeLibrary
GetProcAddress
SetFileTime
TerminateProcess
WriteFile
DisconnectNamedPipe
WriteProfileStringA
CreateProcessA
CreatePipe
Process32Next
Process32First
CreateToolhelp32Snapshot
PeekNamedPipe
SetFilePointer
WaitForSingleObject
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
GetProfileStringA
CopyFileA
CreateEventA
WaitForMultipleObjects
CreateFileA
GetFileSize
ReadFile
GetCurrentProcess
LeaveCriticalSection
GetLastError
GetTempPathA
CloseHandle
InitializeCriticalSection
GetLocalTime
DeleteFileA
LoadLibraryA

advapi32

RegCloseKey
OpenEventLogA
GetOldestEventLogRecord
ReadEventLogA
CloseEventLog
RegOpenKeyExA
RegSetValueExA
RegNotifyChangeKeyValue
RegCreateKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

ws2_32

recv
send
select
socket
inet_addr
htons
gethostbyname
connect
WSAStartup
shutdown
WSAGetLastError
closesocket

msvcrt

__CxxFrameHandler
_fileno
_filelength
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
malloc
free
_CxxThrowException
_purecall
fclose
fwrite
sprintf
fopen
_vsnprintf
??2@YAPAXI@Z
_beginthreadex
atoi
strrchr
??3@YAXPAX@Z
localtime
strstr
_strlwr
_access
strncpy
rand
srand
time
fread
ftell
fseek
fgets
_iob

iphlpapi

GetAdaptersInfo

Exports

Exports

MyStart

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9655d10305ec1e86a31df75e27df066

Headers

File Characteristics

Imports

kernel32

advapi32

ws2_32

msvcrt

iphlpapi

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 2KB