42ff7626e0ada4c28c6671a02b0a521e4ea867fd8af1fff40b5a96c8977c1747

Sharing

Copy URL Twitter E-mail

General

Target

42ff7626e0ada4c28c6671a02b0a521e4ea867fd8af1fff40b5a96c8977c1747
Size

51KB
MD5

a03821483e3662822db276130dafb100
SHA1

a533d62ae02a8223c8db1a70cf9292c985a62ca3
SHA256

42ff7626e0ada4c28c6671a02b0a521e4ea867fd8af1fff40b5a96c8977c1747
SHA512

d1b99eb5089a0d41e471534ba0f96c1264bb91782a705042e10c80472282ca5f340cf98206bb6dd71d3385452a10e8e687fdf6d2893533eb701db31a96eba660
SSDEEP

1536:zoZJdneSO+PPQ54Npg83w8ljb+Jr6SOg+qz:zoe+Q54Npg83w88Jr6DgP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42ff7626e0ada4c28c6671a02b0a521e4ea867fd8af1fff40b5a96c8977c1747

Files

42ff7626e0ada4c28c6671a02b0a521e4ea867fd8af1fff40b5a96c8977c1747
.dll windows:4 windows x64 arch:x64

f49c6c7e32e78b552fc650ad643b4343

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libapr-1

apr_pool_cleanup_register
apr_pool_cleanup_null
apr_pool_create_ex
apr_table_get
apr_strtoi64
apr_file_writev
apr_file_remove
apr_pool_cleanup_kill
apr_file_name_get
apr_file_mktemp
apr_filepath_merge
apr_temp_dir_get
apr_file_seek
apr_hash_make
apr_table_overlay
apr_file_gets
apr_file_printf
apr_env_get
apr_pstrcat
apr_strerror
apr_pvsprintf
apr_ctime
apr_file_open_stdin
apr_pool_userdata_setn
apr_file_open_stdout
apr_pool_userdata_get
apr_cpystrn
apr_hash_get
apr_hash_set
apr_table_make
apr_pstrdup
apr_table_elts
apr_array_make
apr_table_do
apr_array_push
apr_rfc822_date
apr_snprintf
apr_palloc
apr_pstrmemdup
apr_time_now
apr_table_copy
apr_table_addn

libaprutil-1

apr_bucket_shared_copy
apr_bucket_file_create
apr_brigade_partition
apr_bucket_pipe_create
apr_bucket_alloc_destroy
apr_bucket_alloc_create
apr_bucket_type_file
apr_brigade_pflatten
apr_bucket_immortal_create
apr_brigade_length
apr_brigade_flatten
apr_strmatch_precompile
apr_bucket_eos_create
apr_xml_parser_create
apr_xml_parser_feed
apr_xml_parser_done
apr_brigade_create
apr_bucket_type_eos
apr_brigade_cleanup
apr_date_parse_rfc
apr_bucket_shared_split

msvcrt

_iob
_initterm
free
malloc
fprintf
toupper
iscntrl
isalnum
isxdigit
memmove
memcmp
memchr
strchr
strncmp
memset
isspace
memcpy
tolower
isdigit
_stricmp
_strnicmp

kernel32

QueryPerformanceCounter
DisableThreadLibraryCalls
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount

Exports

Exports

apreq_atoi64f
apreq_atoi64t
apreq_brigade_concat
apreq_brigade_fwrite
apreq_brigade_spoolfile
apreq_charset_divine
apreq_cookie_as_string
apreq_cookie_expires
apreq_cookie_make
apreq_cookie_serialize
apreq_cookies
apreq_cp1252_to_utf8
apreq_decode
apreq_decodev
apreq_encode
apreq_file_mktemp
apreq_handle_cgi
apreq_handle_custom
apreq_header_attribute
apreq_hook_apr_xml_parser
apreq_hook_disable_uploads
apreq_hook_discard_brigade
apreq_hook_find_param
apreq_hook_make
apreq_index
apreq_initialize
apreq_join
apreq_param
apreq_param_decode
apreq_param_encode
apreq_param_make
apreq_params
apreq_params_as_array
apreq_params_as_string
apreq_parse_cookie_header
apreq_parse_generic
apreq_parse_headers
apreq_parse_multipart
apreq_parse_query_string
apreq_parse_urlencoded
apreq_parser
apreq_parser_add_hook
apreq_parser_make
apreq_post_initialize
apreq_pre_initialize
apreq_quote
apreq_quote_once
apreq_register_parser
apreq_strerror
apreq_upload
apreq_uploads
apreq_version
apreq_version_string

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f49c6c7e32e78b552fc650ad643b4343

Headers

File Characteristics

Imports

libapr-1

libaprutil-1

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 254B

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 254B