705c585f8a74e238f93c45a3e232a8cf22ae7f5abbaeded770a7b292728a705b

Sharing

Copy URL

Twitter E-mail

General

Target

705c585f8a74e238f93c45a3e232a8cf22ae7f5abbaeded770a7b292728a705b
Size

54KB
MD5

ddcccbab4f1b9852dbb91ebb06ca8d2f
SHA1

e7a5fb47a5d8193ab65fb6f8004a4ebe28c1565c
SHA256

705c585f8a74e238f93c45a3e232a8cf22ae7f5abbaeded770a7b292728a705b
SHA512

1fe58d98ffe881f82f2324e7f09b350944552be917049e65e363a9318d7f5c6a1821ecba3abb89d10bf5972726e9d75529f0fb9de0eae41a4f7e000f4facd9f7
SSDEEP

384:G9vyj40W4bju5pKTzhKB1NBTfyF6dulHDge3hF9ZViJynvmK7l3Ts1FFMxi6o:Fau65pKMBf5fE6tgR9vH7l3Twr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
705c585f8a74e238f93c45a3e232a8cf22ae7f5abbaeded770a7b292728a705b

Files

705c585f8a74e238f93c45a3e232a8cf22ae7f5abbaeded770a7b292728a705b
.dll windows:4 windows x64 arch:x64

5cfeff4ef833e7e3ff297dc1266cdbad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

x64-msvcrt-ruby320

Sleep
onigenc_always_true_is_allowed_reverse_match
onigenc_ascii_apply_all_case_fold
onigenc_ascii_get_case_fold_codes_by_str
onigenc_ascii_mbc_case_fold
onigenc_is_mbc_newline_0x0a
onigenc_minimum_property_name_to_ctype
onigenc_not_support_get_ctype_code_range
onigenc_single_byte_ascii_only_case_map
onigenc_single_byte_code_to_mbc
onigenc_single_byte_code_to_mbclen
onigenc_single_byte_left_adjust_char_head
onigenc_single_byte_mbc_enc_len
onigenc_single_byte_mbc_to_code
rb_enc_register

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__iob_func
_amsg_exit
_initterm
_lock
_onexit
_unlock
abort
calloc
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf

Exports

Exports

Init_iso_8859_11

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 1024B - Virtual size: 523B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 30B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5cfeff4ef833e7e3ff297dc1266cdbad

Headers

File Characteristics

Imports

x64-msvcrt-ruby320

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 88B

.rdata Size: 3KB - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 540B

.xdata Size: 512B - Virtual size: 448B

.bss Size: - Virtual size: 2KB

.edata Size: 512B - Virtual size: 82B

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.reloc Size: 512B - Virtual size: 136B

/4 Size: 512B - Virtual size: 128B

/19 Size: 6KB - Virtual size: 6KB

/31 Size: 1024B - Virtual size: 523B

/45 Size: 1024B - Virtual size: 580B

/57 Size: 512B - Virtual size: 176B

/70 Size: 512B - Virtual size: 30B

/81 Size: 512B - Virtual size: 76B

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 88B

.rdata
Size: 3KB - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 540B

.xdata
Size: 512B - Virtual size: 448B

.bss
Size: - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 82B

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 136B

/4
Size: 512B - Virtual size: 128B

/19
Size: 6KB - Virtual size: 6KB

/31
Size: 1024B - Virtual size: 523B

/45
Size: 1024B - Virtual size: 580B

/57
Size: 512B - Virtual size: 176B

/70
Size: 512B - Virtual size: 30B

/81
Size: 512B - Virtual size: 76B