982c0c936a3335e047057084727de93a1016d87d3372cc083e62281acf4027db

Sharing

Copy URL Twitter E-mail

General

Target

982c0c936a3335e047057084727de93a1016d87d3372cc083e62281acf4027db
Size

9KB
MD5

536d33acdded9f3f3295b60da4ffc1d0
SHA1

b0fe2aa25d9880cd5bc699175ecf0576c9e394b7
SHA256

982c0c936a3335e047057084727de93a1016d87d3372cc083e62281acf4027db
SHA512

2874de84283183911764a1a16b5efb4f5a4a392abecab15f310b7db957ceafc4da259595d51ca3f6bc73458e1dcae45d76d3999c3563619bc7a6ce1379fea794
SSDEEP

96:nPZRJbqOfhPXGFHQ2WlwbvwlKzlKZ0zX9gOIBnvAUphj:nxHbzh/12IlMly0zX9cvVj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
982c0c936a3335e047057084727de93a1016d87d3372cc083e62281acf4027db

Files

982c0c936a3335e047057084727de93a1016d87d3372cc083e62281acf4027db
.dll windows:4 windows x86 arch:x86

20c21864c376f778f4bb2b9b74f5739a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

rtl100.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@RegisterModule$qqrp17System@TLibModule
@System@@RunError$qqruc
@System@@Halt0$qqrv
@System@@StartLib$qqrv
@System@@HandleFinally$qqrv
@System@@AStrCmp$qqrv
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Classes@initialization$qqrv
@Classes@Finalization$qqrv
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv
@Registry@initialization$qqrv
@Registry@Finalization$qqrv
@Inifiles@initialization$qqrv
@Inifiles@Finalization$qqrv

kernel32

TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary

cccore.bpl

@Sharemem@initialization$qqrv
@Sharemem@Finalization$qqrv
@Cformula@initialization$qqrv
@Cformula@Finalization$qqrv
@Cformula@TFormula@MultiplyCmps$qqrd
@Cformula@TFormula@CmpTotal$qqrv
@Cformula@TFormula@GetCmpAmount$qqrr26System@%SmallString$iuc$8%
@Cformula@TFormula@SetCmpAmount$qqrr26System@%SmallString$iuc$8%d
@Cformula@TFormula@SetBase$qqrpx17Cproduct@TBaseInP
@Cmatchin@initialization$qqrv
@Cmatchin@Finalization$qqrv
@Cstrutil@initialization$qqrv
@Cstrutil@Finalization$qqrv
@Cproduct@TProduct@GetBaseByCode$qqrx17System@AnsiString

Exports

Exports

AdjFunc
DeAdjFunc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 102B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20c21864c376f778f4bb2b9b74f5739a

Headers

File Characteristics

Imports

rtl100.bpl

kernel32

cccore.bpl

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.itext Size: 512B - Virtual size: 140B

.data Size: 512B - Virtual size: 44B

.bss Size: - Virtual size: 24B

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 102B

.reloc Size: 512B - Virtual size: 352B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 2KB

.itext
Size: 512B - Virtual size: 140B

.data
Size: 512B - Virtual size: 44B

.bss
Size: - Virtual size: 24B

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 102B

.reloc
Size: 512B - Virtual size: 352B

.rsrc
Size: 1KB - Virtual size: 1KB