e4c07fcb820e95ad11ead2ec3683609da5d278145cdec975affafffacbdce6c0

Sharing

Copy URL Twitter E-mail

General

Target

e4c07fcb820e95ad11ead2ec3683609da5d278145cdec975affafffacbdce6c0
Size

132KB
MD5

d5e5b7dc903c532278c3581960cdf409
SHA1

489831f3cb129ba323adda50a264bee7a4e9d8cb
SHA256

e4c07fcb820e95ad11ead2ec3683609da5d278145cdec975affafffacbdce6c0
SHA512

ef99c3b267bbef129df36464020c341f1af8368b9414e62adfb194eb3ce81e907d7a4bfc8b5179a618d4647abeb453ee69247954315945b575f6a6ccda764e6c
SSDEEP

3072:uciSCoRJPyTPpwsqo7cSxtTBfC4cSi4epsf:80poBtTBg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4c07fcb820e95ad11ead2ec3683609da5d278145cdec975affafffacbdce6c0

Files

e4c07fcb820e95ad11ead2ec3683609da5d278145cdec975affafffacbdce6c0
.dll windows:4 windows x86 arch:x86

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId
GetSystemDefaultLangID
GetVersionExA
GetCurrentProcessId
GetSystemDirectoryA
TerminateProcess
GetHandleInformation
SetFileTime
GetFileTime
GetFileSize
CreateProcessA
LeaveCriticalSection
WriteFile
DisconnectNamedPipe
CreatePipe
WaitForMultipleObjects
ReadFile
PeekNamedPipe
FreeLibrary
SetFilePointer
GlobalFree
FlushFileBuffers
EnterCriticalSection
QueryPerformanceCounter
GetTickCount
DeleteCriticalSection
LoadLibraryA
GetProcAddress
InitializeCriticalSection
GetLocalTime
OpenProcess
CreateFileA
GetCurrentProcess
DuplicateHandle
CloseHandle
DeleteFileA
ExitProcess
GetModuleFileNameA
Sleep
WaitForSingleObject
FreeConsole
GlobalAlloc

user32

GetProcessWindowStation
GetThreadDesktop
GetDC
UpdateWindow
OpenWindowStationA
SetProcessWindowStation
OpenInputDesktop
SetThreadDesktop
GetSystemMetrics
CloseWindowStation
CloseDesktop
PostQuitMessage
DefWindowProcA
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
ReleaseDC
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDCA
CreateCompatibleDC
DeleteDC
CreateDIBSection
BitBlt
DeleteObject
SelectObject
GetStockObject

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
GetUserNameA

ws2_32

inet_ntoa
gethostbyname
gethostname
closesocket
shutdown
send
connect
htons
inet_addr
socket
recv
WSAStartup
select
setsockopt

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

shlwapi

SHGetValueA

msvcrt

_adjust_fdiv
malloc
_initterm
free
strncmp
_vsnprintf
_iob
printf
strchr
sscanf
memcmp
strlen
memcpy
strcpy
rand
strcat
sprintf
_purecall
memset
??2@YAPAXI@Z
__CxxFrameHandler
fopen
fwrite
fclose
strstr
strncpy
wcstombs
_beginthreadex
srand
_strlwr

Exports

Exports

ServiceMain
Start

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

27ee1bd1d66a6e55ae74f1c7781126f8

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

msvcp60

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 112KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 112KB - Virtual size: 112KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 12KB