e7667cd9836e0ebb40c356d6ee499f114aa5f274f8f77b3c4ca361124e52bc91

Sharing

Copy URL

Twitter E-mail

General

Target

e7667cd9836e0ebb40c356d6ee499f114aa5f274f8f77b3c4ca361124e52bc91
Size

200KB
MD5

4eefb46e20568b323d4f74f9c3a7ce4b
SHA1

275bed1663d4bc36f8acfaee3e50957db6fcaa5e
SHA256

e7667cd9836e0ebb40c356d6ee499f114aa5f274f8f77b3c4ca361124e52bc91
SHA512

1cd3d1a624229548ad856e710af877d7b5962411d859839bd59a61cca0261f92f6d4928e4e20b7f87fec284e2ed5f4e5566ffd0b924c7c1320f05676f428be09
SSDEEP

3072:rdHjAJr9J3YSh3FChhySDaXmvWizb2MDwoNy+uTVO8WZTqAlA4SWtpjeTg:GocmvWizlDwoalW5l3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7667cd9836e0ebb40c356d6ee499f114aa5f274f8f77b3c4ca361124e52bc91

Files

e7667cd9836e0ebb40c356d6ee499f114aa5f274f8f77b3c4ca361124e52bc91
.dll windows:4 windows x86 arch:x86

f35fda9af2ba9f02a0c0d3a7121e35dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\temp\mva-d2ts13_tkrefp_1542100483_e\usr\tmp\mva-d2ts13_tkrefp_1542100483_e\tkrefp.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
RaiseException
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
UnhandledExceptionFilter
HeapFree
VirtualAlloc
LoadLibraryA
SetConsoleCtrlHandler
GetStringTypeA
GetStringTypeW
Sleep
LCMapStringA
LCMapStringW
IsValidLocale
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
GetLocaleInfoW
FlushFileBuffers
GetTimeZoneInformation
CloseHandle
SetStdHandle
SetFilePointer
HeapReAlloc

oleaut32

LoadRegTypeLi
SetErrorInfo

Exports

Exports

tkextent
tkrefp

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

HTSTACK_
Size: 4KB - Virtual size: 85B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

SKATOMIC
Size: 4KB - Virtual size: 232B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f35fda9af2ba9f02a0c0d3a7121e35dd

Headers

File Characteristics

PDB Paths

Imports

kernel32

oleaut32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 125KB

HTSTACK_ Size: 4KB - Virtual size: 85B

SKATOMIC Size: 4KB - Virtual size: 232B

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 12KB - Virtual size: 15KB

.data1 Size: 16KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 128KB - Virtual size: 125KB

HTSTACK_
Size: 4KB - Virtual size: 85B

SKATOMIC
Size: 4KB - Virtual size: 232B

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 12KB - Virtual size: 15KB

.data1
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB