e31669f52c15b506a77fcf263613db295b2c5bf2db125467bb71720afceb13b1

Sharing

Copy URL Twitter E-mail

General

Target

e31669f52c15b506a77fcf263613db295b2c5bf2db125467bb71720afceb13b1
Size

116KB
MD5

d9cbdf4cae33e1283a58ac0e8fa1dd58
SHA1

8b0850cc52d662008a01d35ea2cf826b35e609cc
SHA256

e31669f52c15b506a77fcf263613db295b2c5bf2db125467bb71720afceb13b1
SHA512

d5c684c1bf6fee1301ed3f4cae945b88c9846bed8829fb46712f7516dac95db5092173c8c7de1ce1bb2cd9d1d4e1cf5ffcf2058d00988cc3d4682c70f630c1ba
SSDEEP

1536:MI0GklwNzvsH4/KaaWfIzA/3z/wssU36P+IiTXeJcUhufVNNtVRcf48J8/Wj:MDlgvx/K8Yo3zIsbiZKeDoVTRcfZJ8/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e31669f52c15b506a77fcf263613db295b2c5bf2db125467bb71720afceb13b1

Files

e31669f52c15b506a77fcf263613db295b2c5bf2db125467bb71720afceb13b1
.dll windows:5 windows x86 arch:x86

5b022872a2acecfc6d570c30df8b6228

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
DeleteFileA
ExitProcess
HeapAlloc
GetCurrentProcess
HeapFree
Process32First
GetProcessHeap
ExpandEnvironmentStringsA
OpenProcess
WideCharToMultiByte
FreeConsole
CreateEventA
GetLocalTime
Process32Next
GetVersionExA
CreateToolhelp32Snapshot
SetEndOfFile
WriteConsoleW
HeapSize
FlushFileBuffers
SetStdHandle
CreateFileA
HeapReAlloc
GetStringTypeW
LoadLibraryA
GetSystemInfo
GetProcAddress
GetLastError
GetTickCount
GetSystemDefaultLCID
WaitForSingleObject
FreeLibrary
GetModuleFileNameA
GetFileSize
LoadLibraryW
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
DecodePointer
GetCommandLineA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
WriteFile
GetStdHandle
GetModuleFileNameW
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
LCMapStringW
MultiByteToWideChar
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
ReadFile
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetFilePointer
CreateFileW

user32

DefWindowProcA
GetMessageA
PostQuitMessage
LoadIconA
TranslateMessage
GetSystemMetrics
CreateWindowExA
ShowWindow
DispatchMessageA
UpdateWindow
LoadCursorA
RegisterClassA

gdi32

GetStockObject

advapi32

SetServiceStatus
LookupPrivilegeValueA
EqualSid
GetTokenInformation
ConvertSidToStringSidA
RegQueryValueExA
RegisterServiceCtrlHandlerW

ole32

CoCreateGuid

shlwapi

SHRegGetValueA

Exports

Exports

ServiceMain
Start

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b022872a2acecfc6d570c30df8b6228

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

shlwapi

Exports

Exports

Sections

.text Size: 85KB - Virtual size: 85KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 85KB - Virtual size: 85KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 8KB - Virtual size: 7KB