1f5b67df3568f3e854f5fd09f8e25423ad21558a67617d47e3eca34bb9172f37

Sharing

Copy URL

Twitter E-mail

General

Target

1f5b67df3568f3e854f5fd09f8e25423ad21558a67617d47e3eca34bb9172f37
Size

16KB
MD5

cc5da2c634f9efdc10ca72aaf2e34a27
SHA1

0edab44ae085c3a635cf29570eca77918e921705
SHA256

1f5b67df3568f3e854f5fd09f8e25423ad21558a67617d47e3eca34bb9172f37
SHA512

1b449e4749d7c08fb41ceeb614b0790cb589470dcbfc554f4ea3269216174d949c88ec97ae1ec5ea16e66bd9215cc0e5a05b6d080c53871f3538c88ad88f0e01
SSDEEP

192:KPNoR3Z8xuVlNcbnqqr9p7RFdmdo8UFuBlAcY97S7uA/vV+Wi4N3CnGJVDHeg1:ccplVlwDRxmdo8U8BlsdA/Nd3CnSD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f5b67df3568f3e854f5fd09f8e25423ad21558a67617d47e3eca34bb9172f37

Files

1f5b67df3568f3e854f5fd09f8e25423ad21558a67617d47e3eca34bb9172f37
.dll windows:4 windows x86 arch:x86

9e40f7ac71f630703330a8b14a719fb7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
_adjust_fdiv
_initterm
printf
_itoa
strncat
_strtime
fopen
fprintf
fclose
_iob
fflush
time
free
realloc
calloc

kernel32

GetProcAddress
DisableThreadLibraryCalls
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
GetCurrentThreadId
IsBadWritePtr
OutputDebugStringA
GetSystemTime
GetPrivateProfileStringA
LeaveCriticalSection
InterlockedDecrement
InitializeCriticalSection
InterlockedIncrement
EnterCriticalSection
Sleep
FreeLibrary
LoadLibraryA
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetLastError

user32

DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA

Exports

Exports

DosEnterCritSec
DosEnterNamedCritSec
DosExitCritSec
DosExitNamedCritSec
Get_connect_delay
OS_CreateThreadKey
OS_DeleteThreadKey
OS_GetThreadData
OS_SetThreadData
Set_connect_delay
ToFreeDLL
ToLoadDLL
ToLoadDLLFunction
check_ia5
check_numeric
check_printable
debtocalloc
debtofree
debtomalloc
debtorealloc
n_txtout
n_txtout_i
n_txtout_ii
n_txtout_s
strcmpi
strnicmp
toMemNewRealloc
toMemPrvCalloc
toMemPrvClose
toMemPrvFree
toMemPrvGrab
toMemPrvMalloc
toMemPrvOpen
toMemPrvRealloc
toMemPrvRelease
toMemPubCalloc
toMemPubClose
toMemPubFree
toMemPubMalloc
toMemPubRealloc
toatohu
toatohul
toatou
toatoul
tocalloc
tochkptr
tofree
toheapchk
toheapcln
toheapstat
toheapwalk
tohpalloc
tohpcreate
tohpdelete
tohpfree
tois_nul
tomalloc
torealloc
tosprintf
totime
totrap
winsys_sleep
winsys_yield

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e40f7ac71f630703330a8b14a719fb7

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 632B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 632B