edc0aa7ad341753e9fceabc5bdf18b24d942bb7a1e785cdf9e82ea080b0eb4fd

Sharing

Copy URL Twitter E-mail

General

Target

edc0aa7ad341753e9fceabc5bdf18b24d942bb7a1e785cdf9e82ea080b0eb4fd
Size

52KB
MD5

186344e09e1dcbc837ad89f2ba38261f
SHA1

f1431d3b971c910a5e8a088058e25a476440e2c8
SHA256

edc0aa7ad341753e9fceabc5bdf18b24d942bb7a1e785cdf9e82ea080b0eb4fd
SHA512

3806ecba6c6b542663ddc31cef5e06bf0e6470775801a677fe1c7cc578602f267ea602e9af580a34a4933c45ffe7cf47ff3b40f826160fc8e414b49455451312
SSDEEP

1536:KUv18Jy6g/MZ6xXU2Obuu/iJn3ChrI8UqyqU:KUvjla/+Er4qyqU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edc0aa7ad341753e9fceabc5bdf18b24d942bb7a1e785cdf9e82ea080b0eb4fd

Files

edc0aa7ad341753e9fceabc5bdf18b24d942bb7a1e785cdf9e82ea080b0eb4fd
.dll windows:6 windows x86 arch:x86

680d9dc4118445631a5e12994bc77d58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Git\Plugins\e-CryptItEngine\VS Project Files\ZStreamXojo.vcxprojRelease\ProgramDatabase.pdb

Imports

kernel32

MultiByteToWideChar
SetFilePointer
ReadFile
WriteFile
CreateFileW
GetLastError
CloseHandle
SetFilePointerEx
FlushFileBuffers
DeleteCriticalSection
CreateEventW
GetModuleHandleW
GetProcAddress
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

vcruntime140

memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
__std_type_info_destroy_list
memset
__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
_callnewh

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-runtime-l1-1-0

_cexit
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_crt_atexit
_execute_onexit_table

Exports

Exports

REALPluginMain

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

680d9dc4118445631a5e12994bc77d58

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 6KB - Virtual size: 7KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 76B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 6KB - Virtual size: 7KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 76B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB