9f2ed446a8ee66cd88a82eaf5f59e971599d7fa437c2c01fc7b835c2a9c70bb1

Sharing

Copy URL Twitter E-mail

General

Target

9f2ed446a8ee66cd88a82eaf5f59e971599d7fa437c2c01fc7b835c2a9c70bb1
Size

1.6MB
MD5

0c7e2b4c5944ddc01a2ed66aef63a19a
SHA1

d95901ae7e47073249eece063474ae93f2d961c8
SHA256

9f2ed446a8ee66cd88a82eaf5f59e971599d7fa437c2c01fc7b835c2a9c70bb1
SHA512

55c3fb67804c620c55aca9f9b2e6bac5b877eaa69e6bbe6697e2f0de6e7026b5249b148640e72a632a861df4f3263d8c5cb05d9ae6c75bab1af73d58695a1207
SSDEEP

49152:8I7TwSkm4imz7mMTKThwnisrwhjoxTe8Z3Fd6Sxwm3OIr:8YU7X2KsqLZ3Fd6Sv+K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f2ed446a8ee66cd88a82eaf5f59e971599d7fa437c2c01fc7b835c2a9c70bb1

Files

9f2ed446a8ee66cd88a82eaf5f59e971599d7fa437c2c01fc7b835c2a9c70bb1
.dll windows:6 windows x86 arch:x86

d9cce9cac67215391da3d888c5137316

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

pidgenx.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
memmove
memcpy
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsicmp
_purecall
_vsnwprintf
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
wcsstr
wcschr
memset

kernel32

InterlockedExchangeAdd
CreateEventW
CreateSemaphoreW
VirtualQuery
ReleaseSemaphore
SetEvent
WaitForSingleObject
GetModuleFileNameW
GetCurrentThread
GetThreadPriority
GetProcessAffinityMask
RaiseException
UnmapViewOfFile
GetSystemInfo
VirtualProtect
FreeLibrary
LoadLibraryW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibraryAndExitThread
VirtualFree
VirtualAlloc
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
LocalFree
CloseHandle
GetLastError
GetVersionExA
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetLastError
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetVersion
SetThreadPriority
WaitForMultipleObjects
CreateThread
MapViewOfFile
CreateFileMappingW
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter

advapi32

TraceEvent
CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptGenRandom
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
CryptReleaseContext

rpcrt4

UuidToStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidFromStringW

Exports

Exports

PidGenX
PidGenX2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 394KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9cce9cac67215391da3d888c5137316

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 160KB - Virtual size: 159KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 394KB - Virtual size: 396KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 160KB - Virtual size: 159KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 394KB - Virtual size: 396KB