7e3867ff235af750cc7e1fc274924a328cc99a77b4bdd97b9e7803a5e10ad4ef

Sharing

Copy URL Twitter E-mail

General

Target

7e3867ff235af750cc7e1fc274924a328cc99a77b4bdd97b9e7803a5e10ad4ef
Size

894KB
MD5

c1c2f8f92428400f4958953c0b584191
SHA1

20748d7438999963c3a5c1d13e41539d283a69f5
SHA256

7e3867ff235af750cc7e1fc274924a328cc99a77b4bdd97b9e7803a5e10ad4ef
SHA512

dc47bc9cd27c08b6b3199e16c53e086fecf12002ffa34cc3d8ec64e67c87ba67d6f88171704369ec1666de99873e1e2b9f3520e39066bf1ec9518c6f4bbf6acd
SSDEEP

12288:ehhbXYClfDnodVpDmelxAlWilfrBkcI1WGeJwzKsOzTWZl2:ehhbXYGr+VQe0VfrBkcI1W/VsPZl2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e3867ff235af750cc7e1fc274924a328cc99a77b4bdd97b9e7803a5e10ad4ef

Files

7e3867ff235af750cc7e1fc274924a328cc99a77b4bdd97b9e7803a5e10ad4ef
.dll windows:5 windows x86 arch:x86

ada39667f23fd620053fc3bd3ff1a882

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\WorkshopAgent\DevelopProj2\7zArchive\Trunk\7zArchive\CPP\7zip\UI\7zArchive\Bin\Release\SD7zArchive.pdb

Imports

kernel32

DeleteFileW
CreateFileW
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
MoveFileW
MoveFileExW
CreateDirectoryW
RemoveDirectoryW
GetShortPathNameW
LoadLibraryExW
SearchPathW
GetTempPathW
GetTempFileNameW
GetFullPathNameW
FindCloseChangeNotification
FindFirstChangeNotificationW
GetLogicalDriveStringsW
GetFileInformationByHandle
ReadFile
SetEndOfFile
CompareFileTime
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
SetEnvironmentVariableA
CompareStringW
SetFilePointer
WriteFile
MapViewOfFile
GetFileSize
CreateFileMappingW
UnmapViewOfFile
CloseHandle
FreeLibrary
InterlockedCompareExchange
LoadLibraryW
GetLastError
GetProcAddress
GetTickCount
CreateProcessW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
Sleep
SetFileAttributesW
FindNextFileW
HeapAlloc
HeapFree
RtlUnwind
DecodePointer
EncodePointer
RaiseException
GetCurrentThreadId
GetPrivateProfileStringW
GetModuleHandleW
ExitProcess
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
FindClose
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetStdHandle
WriteConsoleW
FlushFileBuffers
lstrlenA
LocalFree
FormatMessageA
LoadResource
FindResourceExW
FormatMessageW
GetVersionExW
InitializeCriticalSection
SleepEx
CreateSemaphoreW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
CreateEventW
SetEvent
PulseEvent
ResetEvent
WaitForMultipleObjects
GetSystemInfo
FreeConsole
AllocConsole
GetLocalTime
LoadLibraryA
lstrcmpA
LocalAlloc
SetFileTime
TlsAlloc
OutputDebugStringW
GetProfileStringW
GetWindowsDirectoryW
GetModuleFileNameW
GetCurrentDirectoryW
GetSystemDirectoryW
GetSystemTime
SystemTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
lstrlenW
VirtualFree
GetCommandLineA
VirtualAlloc
VirtualQuery
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
SuspendThread
GetExitCodeThread
GetVersion
CreateFileA
MoveFileA
GetProcessHeap

user32

CharUpperW
MsgWaitForMultipleObjects
GetUserObjectInformationW
GetSystemMetrics
MessageBoxW
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
CharToOemW

advapi32

OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyA
RegCreateKeyW
RegOpenKeyW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyW
RegSetValueExA
RegQueryValueExA
RegConnectRegistryW
OpenServiceW
DeregisterEventSource
ReportEventA
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegisterEventSourceA

oleaut32

SysStringByteLen
VariantClear
VariantCopy
SysAllocStringByteLen
SysAllocString

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdi32

DeleteDC
GetBitmapBits
DeleteObject
BitBlt
GetObjectA
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA

Exports

Exports

Compress
DeleteFolder
EmumExtractDir
EmumExtractDir_LP
Extract
Extract1
Extract1_LP
Extract2
Extract2_LP
GetFileCount
GetFileInfo
GetFileInfo_LP
IsCompressFile
MulCompress
MulCompress_LP
MulExtract
MulExtract_LP
SetArcCompressMode
SetArcExtractFormats

Sections

.text
Size: 685KB - Virtual size: 685KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ada39667f23fd620053fc3bd3ff1a882

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

Exports

Exports

Sections

.text Size: 685KB - Virtual size: 685KB

.rdata Size: 110KB - Virtual size: 110KB

.data Size: 54KB - Virtual size: 87KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 685KB - Virtual size: 685KB

.rdata
Size: 110KB - Virtual size: 110KB

.data
Size: 54KB - Virtual size: 87KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 41KB - Virtual size: 40KB