69570347a370738ad8ebb118a2b8044095d98eb0123db61f146b77a87a5f1da6

Sharing

Copy URL Twitter E-mail

General

Target

69570347a370738ad8ebb118a2b8044095d98eb0123db61f146b77a87a5f1da6
Size

83KB
MD5

d2bd0fecc7cadb84079c764adc07663b
SHA1

392f74357a85e3948afd12f77460c55b8014d638
SHA256

69570347a370738ad8ebb118a2b8044095d98eb0123db61f146b77a87a5f1da6
SHA512

fc400e710ddb8c3ca7eb8ca878b35c80f53206a6e827e2f15b7dc4a1540221b3e30c012bd327d276267a44cf5d6c64fc3c1d7e348b074e4ef70a376e848db754
SSDEEP

1536:WFBZBN1hHunw2Bx4KPI5N+co7IizJoCYpY+CsWqKcd3SijAQoEq:WwxI58l7IJH53SijAQoEq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69570347a370738ad8ebb118a2b8044095d98eb0123db61f146b77a87a5f1da6

Files

69570347a370738ad8ebb118a2b8044095d98eb0123db61f146b77a87a5f1da6
.dll windows:6 windows x86 arch:x86

55e8bbaadd47149deea3c8b5e413e915

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\TheadCore\TheadCore\UMThread\Release\UMThread.pdb

Imports

kernel32

SetThreadPriority
WaitForSingleObject
CloseHandle
CreateThread
CreateEventW
SetEvent
ResetEvent
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW

Exports

Exports

Event_Check
Event_Create
Event_Release
Event_Reset
Event_Set
Event_Wait
Event_WaitInfinite
Mutex_Create
Mutex_Lock
Mutex_Release
Mutex_Trylock
Mutex_Unlock
Thread_Command
Thread_Create
Thread_GetStatus
Thread_GetStatusNolock
Thread_IsCompleted
Thread_Pause
Thread_Release
Thread_SetNextWaitTime
Thread_Start
Thread_Stop
Thread_WaitComplete

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55e8bbaadd47149deea3c8b5e413e915

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 50KB - Virtual size: 49KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 4KB