34203d7f1bd57e5bcbcc0a66acc2357d0a59704da73a24ffc3058231946005d1

Sharing

Copy URL Twitter E-mail

General

Target

34203d7f1bd57e5bcbcc0a66acc2357d0a59704da73a24ffc3058231946005d1
Size

1.6MB
MD5

2340e5b250b7620314b831bfbd3954d8
SHA1

7eb3aa4a8bf8ce64a68a6d2ddd4a77c26ec66c81
SHA256

34203d7f1bd57e5bcbcc0a66acc2357d0a59704da73a24ffc3058231946005d1
SHA512

118bdd7fb304be8b09cf1a48430aed58476a0063086db71e76199fabf9e47ce67e92a930f26b2672087a2a8be244a58f2f8f87c88e0d8d5dacea47ee659fabbe
SSDEEP

49152:VJ/pN/1XuGgYW9TZnJ1zAOzvTa8Z/uQLImUO:VpVnEkg5Z/VI9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34203d7f1bd57e5bcbcc0a66acc2357d0a59704da73a24ffc3058231946005d1

Files

34203d7f1bd57e5bcbcc0a66acc2357d0a59704da73a24ffc3058231946005d1
.dll windows:6 windows x86 arch:x86

d9cce9cac67215391da3d888c5137316

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

pidgenx.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
memmove
memcpy
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsicmp
_purecall
_vsnwprintf
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
wcsstr
wcschr
memset

kernel32

InterlockedExchangeAdd
CreateEventW
CreateSemaphoreW
VirtualQuery
ReleaseSemaphore
SetEvent
WaitForSingleObject
GetModuleFileNameW
GetCurrentThread
GetThreadPriority
GetProcessAffinityMask
RaiseException
UnmapViewOfFile
GetSystemInfo
VirtualProtect
FreeLibrary
LoadLibraryW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibraryAndExitThread
VirtualFree
VirtualAlloc
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
LocalFree
CloseHandle
GetLastError
GetVersionExA
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetLastError
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetVersion
SetThreadPriority
WaitForMultipleObjects
CreateThread
MapViewOfFile
CreateFileMappingW
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter

advapi32

TraceEvent
CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptGenRandom
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
CryptReleaseContext

rpcrt4

UuidToStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidFromStringW

Exports

Exports

PidGenX
PidGenX2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 386KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9cce9cac67215391da3d888c5137316

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 160KB - Virtual size: 159KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 386KB - Virtual size: 388KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 160KB - Virtual size: 159KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 386KB - Virtual size: 388KB