c6bda4f7de2b86a77b141242f8aeae6c52b6fa7872e8756c8d001759decbb150

Sharing

Copy URL Twitter E-mail

General

Target

c6bda4f7de2b86a77b141242f8aeae6c52b6fa7872e8756c8d001759decbb150
Size

4.4MB
MD5

acffa35f2e17423910c023b9a033e97a
SHA1

43b2e4ede10e1bfa083232165c9a6a5f4aa73b51
SHA256

c6bda4f7de2b86a77b141242f8aeae6c52b6fa7872e8756c8d001759decbb150
SHA512

734846c532591f4385477d5621aeeebbd9cef85d6361b169b402a75e06c03d91dd84b013cbc1708bca01c22f0f7acf4cbbc14af7696d6c673797b210676e03ec
SSDEEP

49152:uSDG0PlKpFvKvWySGO3XtQJ7GTunOmus3SVxOjTUMkT5DQZRjEkAXJfvtaz:00PQFvKvWySG+W3UzcIlv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6bda4f7de2b86a77b141242f8aeae6c52b6fa7872e8756c8d001759decbb150

Files

c6bda4f7de2b86a77b141242f8aeae6c52b6fa7872e8756c8d001759decbb150
.dll windows:5 windows x86 arch:x86

7a5706392765a0cd20408397119e4140

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\lynda\download\themida\Codedoctor\_Output\Olly (Debug)\CodeDoctor.pdb

Imports

ollydbg.exe

ord24
ord108
ord172
ord2
ord60
ord53
ord44
ord4
ord88
ord101
ord117
ord160
ord107
ord186
ord102
ord98
ord78

user32

GetDlgItemTextA
GetParent
SendMessageA
SendDlgItemMessageA
SetDlgItemTextA
GetWindowRect
SystemParametersInfoA
SetWindowPos
MessageBoxA
PeekMessageA
LoadStringA
LoadStringW

kernel32

GetProcessHeap
CreateHardLinkW
CreateDirectoryW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesA
FindNextFileA
FindClose
FindFirstFileA
CopyFileA
MoveFileA
FindNextFileW
FindFirstFileW
GetShortPathNameW
FormatMessageA
LocalFree
SetFileTime
GetFileTime
CreateHardLinkA
GetFullPathNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDiskFreeSpaceExA
DeleteFileW
OpenProcess
CreateProcessA
CloseHandle
TerminateProcess
WriteProcessMemory
ReadProcessMemory
GetTickCount
CreateDirectoryA
VirtualAllocEx
SetThreadContext
GetThreadContext
GetCurrentThread
WaitForSingleObject
CreateThread
CreateEventA
OpenThread
GetCurrentThreadId
SetEvent
ResumeThread
GetLastError
SuspendThread
Sleep
OutputDebugStringA
LoadLibraryW
SetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
LoadLibraryA
GetTempPathA
SizeofResource
LockResource
LoadResource
DeleteFileA
FindResourceA
GetSystemWindowsDirectoryA
GetModuleFileNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
RaiseException
lstrlenA
RtlUnwind
EncodePointer
DecodePointer
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteConsoleW
GetFileType
GetStdHandle
GetCommandLineA
HeapValidate
IsBadReadPtr
HeapFree
HeapAlloc
CopyFileW
VirtualQuery
FreeLibrary
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
ExitProcess
WriteFile
OutputDebugStringW
SetConsoleCtrlHandler
SetHandleCount
GetStartupInfoW
SetFilePointer
ReadFile
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
HeapQueryInformation
InterlockedExchange
SetStdHandle
CreateFileA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetEndOfFile
CreateFileW
InitializeCriticalSection
GetStringTypeExA
LCMapStringA
GetStringTypeExW
InterlockedCompareExchange
GetFileAttributesExA
RemoveDirectoryA
MoveFileW
RemoveDirectoryW

Exports

Exports

_ODBG_Pausedex
_ODBG_Pluginaction
_ODBG_Plugindata
_ODBG_Plugindestroy
_ODBG_Plugininit
_ODBG_Pluginmenu
_ODBG_Pluginshortcut

Sections

.textbss
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 671KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a5706392765a0cd20408397119e4140

Headers

File Characteristics

PDB Paths

Imports

ollydbg.exe

user32

kernel32

Exports

Exports

Sections

.textbss Size: - Virtual size: 1.6MB

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 671KB - Virtual size: 671KB

.data Size: 276KB - Virtual size: 437KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 121KB - Virtual size: 120KB

.textbss
Size: - Virtual size: 1.6MB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 671KB - Virtual size: 671KB

.data
Size: 276KB - Virtual size: 437KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 121KB - Virtual size: 120KB