e0972d926065013f8c53e342b7ef476bdf33f984f8dc7fa8336bced9811d2209

Sharing

Copy URL Twitter E-mail

General

Target

e0972d926065013f8c53e342b7ef476bdf33f984f8dc7fa8336bced9811d2209
Size

70KB
MD5

4802e3eae2569b02112a133eaef22394
SHA1

e3e96e57c6675ea76eefcd2e0a421cc0886af4ab
SHA256

e0972d926065013f8c53e342b7ef476bdf33f984f8dc7fa8336bced9811d2209
SHA512

b5e19cf1ee8e5eba20c750d7dc0135902ecf9021615adcce1a581cf608f1a10f76ce73ca74f93d4b2ab41be71c460f007c1f7fa2c8eb029ea6c1debc4bb2079e
SSDEEP

1536:N1DNRG97zFFsqrsYZB1atTrFZC2Re+IwM3VJejesGp:7DuJpF33H18oTpsSsGp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0972d926065013f8c53e342b7ef476bdf33f984f8dc7fa8336bced9811d2209

Files

e0972d926065013f8c53e342b7ef476bdf33f984f8dc7fa8336bced9811d2209
.dll windows:4 windows x86 arch:x86

65ab8312656177202b4410ce3a5cdbb1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
RegCloseKey
RegSetValueExA
RegOpenKeyExA
CloseEventLog
ReadEventLogA
GetOldestEventLogRecord
OpenEventLogA

ws2_32

closesocket
WSAGetLastError
send
recv
select
socket
inet_addr
htons
gethostbyname
connect
WSAStartup
shutdown

iphlpapi

GetAdaptersInfo

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetEndOfFile
GetOEMCP
CloseHandle
GetLastError
GetCurrentProcess
ReadFile
GetFileSize
CreateFileA
WaitForMultipleObjects
CreateEventA
Sleep
GetProfileStringA
SetFileTime
SystemTimeToFileTime
GetSystemTime
ExpandEnvironmentStringsA
GetModuleFileNameA
LeaveCriticalSection
GetLocalTime
EnterCriticalSection
InitializeCriticalSection
ExitProcess
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetFileTime
GetSystemDirectoryA
MoveFileA
DeleteFileA
DuplicateHandle
OpenProcess
FreeLibrary
GetProcAddress
LoadLibraryA
TerminateProcess
WriteFile
DisconnectNamedPipe
WriteProfileStringA
CreateProcessA
CreatePipe
Process32Next
Process32First
CreateToolhelp32Snapshot
PeekNamedPipe
SetFilePointer
WaitForSingleObject
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
RtlUnwind
GetFileAttributesA
GetTimeZoneInformation
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
TlsAlloc
TlsFree
SetLastError
TlsGetValue
UnhandledExceptionFilter
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP

Exports

Exports

MyStart

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65ab8312656177202b4410ce3a5cdbb1

Headers

File Characteristics

Imports

advapi32

ws2_32

iphlpapi

kernel32

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 51KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 5KB - Virtual size: 13KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 51KB - Virtual size: 51KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 5KB - Virtual size: 13KB

.reloc
Size: 5KB - Virtual size: 5KB