7296abe54f29c4db0ebed0e9334c7628e692be44608a6b46928b53ed1d643c7c

Sharing

Copy URL Twitter E-mail

General

Target

7296abe54f29c4db0ebed0e9334c7628e692be44608a6b46928b53ed1d643c7c
Size

17KB
MD5

0c913915d6446d782ce69ee7dfa486b3
SHA1

393d2460ce9bc8c2c38fa0dce55e87d8dbd53fb5
SHA256

7296abe54f29c4db0ebed0e9334c7628e692be44608a6b46928b53ed1d643c7c
SHA512

6f478d5b0c40fdee3c3fab4cafc6408451b8640621388a40ccea14add9dcfb68ccab3921178b4f86536bf464e7e5cba41b831fc5a775a3f122f7c381efbeab89
SSDEEP

384:rAlBQ9ZDurt4N7l1aiaV3kO1Ph7muaDTFhrARoG7GT:2MhnNTaiy3koJ7mhDTrrmoG7G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7296abe54f29c4db0ebed0e9334c7628e692be44608a6b46928b53ed1d643c7c

Files

7296abe54f29c4db0ebed0e9334c7628e692be44608a6b46928b53ed1d643c7c
.dll windows:6 windows x86 arch:x86

0cbe89fbadb180ff03026c640e864faf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Law\Documents\Visual Studio 2015\Projects\UnitedCheat\UnitedCheat\bin\Release\Plugin.pdb

Imports

kernel32

CreateToolhelp32Snapshot
MultiByteToWideChar
GetLastError
Process32NextW
LockResource
Process32FirstW
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
HeapSize
FindResourceW
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
IsWow64Process
OutputDebugStringW
IsDebuggerPresent
OpenProcess
InitializeCriticalSectionEx
HeapFree
WriteProcessMemory
LoadResource
SizeofResource
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
EnterCriticalSection

advapi32

CloseServiceHandle
OpenSCManagerW
DeleteService
OpenServiceW
CreateServiceW

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
__CxxFrameHandler3
memset
_CxxThrowException
__vcrt_InitializeCriticalSectionEx
memcpy

api-ms-win-crt-string-l1-1-0

wmemcpy_s
_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_errno
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_atexit
_invalid_parameter_noinfo

api-ms-win-crt-heap-l1-1-0

free

Exports

Exports

GetHandle
InstallService
Load
UninstallService
WPM
closeHandle

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cbe89fbadb180ff03026c640e864faf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 788B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 788B