628e39a4d580caecc339ea1109c60c66aa09118fbda7a1f8e4ac3180ff6d4b28

Sharing

Copy URL

Twitter E-mail

General

Target

628e39a4d580caecc339ea1109c60c66aa09118fbda7a1f8e4ac3180ff6d4b28
Size

131KB
MD5

719e9a5e84721f5d750b25b463d5e280
SHA1

d7c922bc9544cd693d9abad5217818aa59c23c24
SHA256

628e39a4d580caecc339ea1109c60c66aa09118fbda7a1f8e4ac3180ff6d4b28
SHA512

5eed54ced80db196ce66875207192466ec166e76201ae988d96a301cf0e68847fc6c74d49aed44b099e005e3be09e5ccf998d9ce2f9ed07e8e49b836f48ba437
SSDEEP

768:M3pAgqaHZzYeXZ3KYoLeSCpCqYT4JRQMqZsp1vBfFe4IxAzVGn0EYgjR5KWk:M3eDBAtK0pCqYTYlOhezVGTYq5k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
628e39a4d580caecc339ea1109c60c66aa09118fbda7a1f8e4ac3180ff6d4b28

Files

628e39a4d580caecc339ea1109c60c66aa09118fbda7a1f8e4ac3180ff6d4b28
.dll windows:4 windows x86 arch:x86

1ddfa109e8d8aa9229413d5f5b9eced4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

DestroyWindow
CreateWindowExA
DefWindowProcA
wsprintfA
SendMessageA
PostMessageA
LoadStringA
RegisterClassA

kernel32

SetFilePointer
CreateFileA
WriteFile
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
SetThreadPriority
CreateThread
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrcatA
lstrcpyA
GetModuleFileNameA
CloseHandle
Sleep
GetTickCount
lstrcpynA
GetProcAddress
LoadLibraryA
GetVersion
GetModuleHandleA
FreeLibrary
lstrcmpiA
lstrlenA
GetLocalTime
lstrcmpA
WritePrivateProfileStringA
GetDateFormatA
WritePrivateProfileSectionA
DeviceIoControl
GetCommModemStatus
GetTimeFormatA
GetStdHandle
GetFileType
GetFileSize
SetHandleCount
SetEndOfFile
ReadFile
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentProcess
HeapCreate
HeapFree
HeapAlloc
GetCommandLineA
HeapDestroy
VirtualFree
VirtualAlloc
ExitProcess
TerminateProcess

wsock32

gethostname
gethostbyname
WSACleanup
WSAStartup
inet_addr

advapi32

GetUserNameA

Exports

Exports

CoreDelServiceInfo
CoreExit
CoreGetLogItems
CoreGetLogPath
CoreGetStatusChar
CoreGetStatusWord
CoreInit
CoreLoadServiceInfo
CoreRegisterLogMessage
CoreRegisterMessage
CoreRegisterNotifyMessage
CoreRunDialog
CoreSaveServiceInfo
CoreSetLogPath
CoreSetStatusWord
CoreSetup
CoreShutdown

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ddfa109e8d8aa9229413d5f5b9eced4

Headers

File Characteristics

Imports

user32

kernel32

wsock32

advapi32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.sdata Size: 80KB - Virtual size: 79KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 5KB - Virtual size: 6KB

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 844B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 34KB - Virtual size: 34KB

.sdata
Size: 80KB - Virtual size: 79KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 5KB - Virtual size: 6KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 844B

.reloc
Size: 5KB - Virtual size: 4KB