ffa980b2a4a88c68f62288de56e9cfccacbb3f738492f98dff419c5f2f897377

Sharing

Copy URL

Twitter E-mail

General

Target

ffa980b2a4a88c68f62288de56e9cfccacbb3f738492f98dff419c5f2f897377
Size

388KB
MD5

5431da1b5c2bb3dc02dc23e27aba4947
SHA1

20751ebd12013a4619d034fc46f43cb80ba91265
SHA256

ffa980b2a4a88c68f62288de56e9cfccacbb3f738492f98dff419c5f2f897377
SHA512

e3d5ac7846ddab7fa48237d23bdc3d4a17322f4a3f9b450ee2f057fc1e3549da9426be1b35a9dbef44a4d2789dfa7d461e446c7dbfa51ab2bac187f042af98d6
SSDEEP

12288:ARt8fHGDQJfuZhCfSp2b6UlDTNDpfh1o6Xs1:ARWvG0J2CKobvlP91o2s1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffa980b2a4a88c68f62288de56e9cfccacbb3f738492f98dff419c5f2f897377

Files

ffa980b2a4a88c68f62288de56e9cfccacbb3f738492f98dff419c5f2f897377
.dll windows:4 windows x86 arch:x86

5551e198de5e041b311d0c076bb8c664

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CryptSetProviderA

crypt32

CryptMemAlloc
CryptMemFree
CryptMsgClose

iphlpapi

GetPerAdapterInfo
GetTcpStatistics
GetTcpTable
GetUdpStatistics
GetUdpTable
GetUniDirectionalAdapterInfo
IpReleaseAddress
IpRenewAddress
SetIfEntry
SetIpNetEntry
SetIpStatistics

kernel32

ClearCommBreak
CloseHandle
GetCompressedFileSizeA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetFileSize
GetFileType
GetLastError
GetLogicalDrives
GetProcessVersion
GetTempPathA
GetThreadPriority
SetCommBreak
SetCurrentDirectoryA
SetEndOfFile
SuspendThread
VirtualAlloc
VirtualProtect

user32

GetCaretPos
GetClassWord
GetClientRect
GetInputState

Exports

Exports

AllowDownload
AngleBoxDrivesEntries
AviDeferDrive
ClearMessage
ClientSendCurrentParam
DestroyMutexLast
DispatchBk
EllipseFlat
EllipseParentVersionEx
EllipsePwrFeatureMulti
EncryptPlay
EndExit
EndHash
EqualDateUpLog
EqualService
EscapeTimeSoundFile
ExitClassSpaces
ExtClipboardSize
ExtractAutoPrepareDacl
ExtractSid
FrameNotify
GrayDecryptHashRgn
HeapSeek
InflateNextConnectedEnum
InflateRestoreDescriptorEvent
InitShut
InitializeParent
IntersectCheckBy
KeyInitialize
LineCanonicalize
LineFontIs
LocalDial
MciNativeOf
MessageFault
MmioIcon
MouseBoxDirectionContainer
OutputNext
PageDlgFontTimer
PolyPipeUpdate
PostPixelStringsWow
Process32HostFill
ShBinaryCache
SwitchCombineDataNumeric
TerminatePortsAddress
TrackClientDcEnum
TrackPrivateProfile
TrackValid
VdmTask
WaveAlphaUncTable
WsaPixel

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 205KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5551e198de5e041b311d0c076bb8c664

Headers

File Characteristics

Imports

advapi32

crypt32

iphlpapi

kernel32

user32

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 21KB

.data Size: 1024B - Virtual size: 672B

.rdata Size: 344KB - Virtual size: 344KB

.bss Size: - Virtual size: 205KB

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 816B

.text
Size: 22KB - Virtual size: 21KB

.data
Size: 1024B - Virtual size: 672B

.rdata
Size: 344KB - Virtual size: 344KB

.bss
Size: - Virtual size: 205KB

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 816B