eba90ffbd2f03c50191036b0ef945c4c0b71e46f80a640fc448e2660f4138628

Sharing

Copy URL Twitter E-mail

General

Target

eba90ffbd2f03c50191036b0ef945c4c0b71e46f80a640fc448e2660f4138628
Size

15KB
MD5

8e288fb1910b56b3873ecf78f7e96a56
SHA1

22e5b5314d2d0ffedb51befde6db18c12adfbd13
SHA256

eba90ffbd2f03c50191036b0ef945c4c0b71e46f80a640fc448e2660f4138628
SHA512

393b27c3229b6a67833597faa5b51827e7be5f24c6384cd3d6120cc07dc54022854a5dd9950e03ac959e669321a3a66d29934511625a11cb203ee7f96d24b897
SSDEEP

192:AlJW870RipNWslT1JRBWBUVGu2JxcnYYRZZZZZZZZZZZEZZZj82sAH1slxCeZ/rf:0J570RiHf5bWj7XHelNZtyK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eba90ffbd2f03c50191036b0ef945c4c0b71e46f80a640fc448e2660f4138628

Files

eba90ffbd2f03c50191036b0ef945c4c0b71e46f80a640fc448e2660f4138628
.dll windows:4 windows x86 arch:x86

30a13bd2e4d7d7715ef4ad7f43431dc9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt-ruby240

Sleep@4
fcntl
rb_cIO
rb_define_method
rb_ensure
rb_error_arity
rb_f_notimplement_
rb_io_check_closed
rb_io_set_nonblock
rb_io_taint_check
rb_sys_fail
rb_yield

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

_amsg_exit
_initterm
_iob
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf

Exports

Exports

Init_nonblock

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 976B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30a13bd2e4d7d7715ef4ad7f43431dc9

Headers

File Characteristics

Imports

msvcrt-ruby240

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 48B

.rdata Size: 1KB - Virtual size: 1KB

.eh_fram Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 976B

.edata Size: 512B - Virtual size: 76B

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 1024B - Virtual size: 544B

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 48B

.rdata
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 976B

.edata
Size: 512B - Virtual size: 76B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 1024B - Virtual size: 544B