63cb39925958bbd8f2de3081373bcc901c5e8737bfaa7d06fd8153f7df8485e0

General

Target

63cb39925958bbd8f2de3081373bcc901c5e8737bfaa7d06fd8153f7df8485e0
Size

181KB
MD5

5e843219bbe406946ff4d19f7de30bd1
SHA1

114dd1a5463a61fbf88313dce542f350cda92a84
SHA256

63cb39925958bbd8f2de3081373bcc901c5e8737bfaa7d06fd8153f7df8485e0
SHA512

0d42f1eb6a7f423775bdd6c6d910269e5ae4527da91effba7418ffb2b71da694d3f938e4fc111f15bef90d7cb41b327f628a47e8ce2c961fd17101d4b4789717
SSDEEP

3072:7Nk6j3MrCioOXEANmQl37PqiOG3iX662U2z56KS2k/nRt/D8MHKg:/3Mjoy15l3eiOG3iXKlz5Jk/nDHHKg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63cb39925958bbd8f2de3081373bcc901c5e8737bfaa7d06fd8153f7df8485e0

Files

63cb39925958bbd8f2de3081373bcc901c5e8737bfaa7d06fd8153f7df8485e0
.dll windows:4 windows x86 arch:x86

9d6b16b107d506b2663aa83ac4fa8ef6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

win32k.sys

EngComputeGlyphSet
EngLoadModule
EngGetDriverName
EngFreeMem
EngAssociateSurface
EngCreateDeviceSurface
EngDeleteSurface
EngDeletePalette
EngFreeModule
EngCreatePalette
EngWritePrinter
EngAllocMem
BRUSHOBJ_pvGetRbrush
EngUnlockSurface
BRUSHOBJ_pvAllocRbrush
XLATEOBJ_piVector
EngStretchBlt
EngCopyBits
EngEraseSurface
FLOATOBJ_GetLong
FLOATOBJ_SetFloat
FONTOBJ_pifi
EngUnicodeToMultiByteN
STROBJ_bEnum
STROBJ_vEnumStart
FLOATOBJ_LessThan
FLOATOBJ_DivFloat
XFORMOBJ_bApplyXform
XFORMOBJ_iGetXform
FONTOBJ_pxoGetXform
FONTOBJ_cGetGlyphs
EngFindResource
EngSetLastError
EngMulDiv
FLOATOBJ_GetFloat
FLOATOBJ_DivLong
FLOATOBJ_SetLong
CLIPOBJ_bEnum
CLIPOBJ_cEnumStart
PATHOBJ_bEnum
PATHOBJ_vEnumStart
PATHOBJ_bEnumClipLines
PATHOBJ_vEnumStartClipLines
PATHOBJ_vGetBounds
EngDeletePath
CLIPOBJ_ppoGetPath
EngLockSurface
EngCreateBitmap
EngDeleteClip
EngCreateClip
PATHOBJ_bCloseFigure
PATHOBJ_bPolyLineTo
PATHOBJ_bPolyBezierTo
PATHOBJ_bMoveTo
EngCreatePath
EngBitBlt
EngFillPath
FONTOBJ_pvTrueTypeFontFile
EngMultiByteToUnicodeN
EngMapModule
EngUnloadImage
EngFindImageProcAddress
EngLoadImage
EngGetPrinterData

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d6b16b107d506b2663aa83ac4fa8ef6

Headers

File Characteristics

Imports

win32k.sys

Sections

.text Size: 53KB - Virtual size: 53KB

.data Size: 48KB - Virtual size: 48KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 40KB - Virtual size: 40KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 53KB - Virtual size: 53KB

.data
Size: 48KB - Virtual size: 48KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 40KB - Virtual size: 40KB

.reloc
Size: 2KB - Virtual size: 1KB