19632b50454d2a773dba757b940b672e1d47643bb6b41dc427d3dfbff0cc9bd2

Sharing

Copy URL Twitter E-mail

General

Target

19632b50454d2a773dba757b940b672e1d47643bb6b41dc427d3dfbff0cc9bd2
Size

56KB
MD5

7cf736d497e291cf3c45cf137ba76caf
SHA1

c69d0d69969a1bd44c1bc3d9c7c545c393566e7f
SHA256

19632b50454d2a773dba757b940b672e1d47643bb6b41dc427d3dfbff0cc9bd2
SHA512

88b685d8a3cf9c4f37c4584884dc8168809401dc373a11c440814928e401c3bb32b66bb54174ce8c14ac080f4c47cc3d09e33b71018f72f50c3bb43966629190
SSDEEP

1536:IuAMRnLQ/Cf9MU3QKlxTS2bmKZguoZQ0:lAMRnLQ/CF7gKlUuguoZ7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19632b50454d2a773dba757b940b672e1d47643bb6b41dc427d3dfbff0cc9bd2

Files

19632b50454d2a773dba757b940b672e1d47643bb6b41dc427d3dfbff0cc9bd2
.dll windows:4 windows x86 arch:x86

e5b5dbdb984e4a4be606c2dd70c4162e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateEventA
CreateFileA
TerminateThread
SetEvent
CreateThread
ReadFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteFile
WaitForSingleObject
CancelIo
ResetEvent
GetOverlappedResult
Sleep
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
RtlUnwind

user32

KillTimer
PostMessageA
SetTimer

hid

HidD_GetAttributes
HidD_GetPreparsedData
HidP_GetCaps
HidD_FreePreparsedData
HidD_GetHidGuid

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

winmm

mciSendCommandA
mixerGetLineControlsA
mixerSetControlDetails
mixerOpen
mixerGetLineInfoA
mixerClose

Exports

Exports

Bell
BindWindow
CallReject
DelNewSms
EaroffHook
Flash
GetDllVer
GetMissCid
GetSerialNo
GetUsbVer
HangUpCtrl
Hold
InitDll
Mute
OffHookCtrl
QueryPhoneStatus
SendDTMF
SendSmsText
SetAutoAnswer
SetDialTone
SetFlashTime
SetOutcode
SetSerialNo
StartDial
StartRecordFile
StopRecordFile
UnBindWindow
ZhuanBo
setIcm
setLeaveRecord
setLocalRecord
setPCEarEar
setPCEarSpk
setRecord
setTalkRecord

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5b5dbdb984e4a4be606c2dd70c4162e

Headers

File Characteristics

Imports

kernel32

user32

hid

setupapi

winmm

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 4KB - Virtual size: 2KB