011e63e8b2bef3ba2ed7a0378606048f0fe078b64649b657b9e9c81018ac2993

Sharing

Copy URL Twitter E-mail

General

Target

011e63e8b2bef3ba2ed7a0378606048f0fe078b64649b657b9e9c81018ac2993
Size

222KB
MD5

6362fe0bb4a1d47d970506f3e7d620cb
SHA1

9ce1699930c4562cf299975817d5fb0d0fafc40b
SHA256

011e63e8b2bef3ba2ed7a0378606048f0fe078b64649b657b9e9c81018ac2993
SHA512

1af665f602cfb14de5a3ee02efa72f36c42d5739ea9e8321c0cf303eff85bcb1312e1d0effd2197d591756022d6603f8c20b628d3a0fedb48df2a9d133eeefba
SSDEEP

3072:wbo34GjU29Z/9g5OdQReXn2c1LHJD/7BZB8KBHrjhShbfUJmr5vsqJ:wbohj9Z/6qNzv1/UtRVx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
011e63e8b2bef3ba2ed7a0378606048f0fe078b64649b657b9e9c81018ac2993

Files

011e63e8b2bef3ba2ed7a0378606048f0fe078b64649b657b9e9c81018ac2993
.dll windows:5 windows x86 arch:x86

254681eeafadadd1580b3169d3fec973

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\work\code\VRVAnyWhere\edpCemsTrans\Trunk\Release\edpCemsTrans.pdb

Imports

kernel32

WideCharToMultiByte
Sleep
GetTickCount
CloseHandle
CreateFileA
FlushFileBuffers
ReadFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
IsValidLocale
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
HeapAlloc
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetModuleHandleW
GetProcAddress
ExitProcess
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
CompareStringA
GetCPInfo
CompareStringW
LCMapStringA
LCMapStringW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
GetModuleHandleA

ole32

StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize

ws2_32

recv
__WSAFDIsSet
select
WSAStartup
send

Exports

Exports

AuthTranserver
InitTrans

Sections

.text
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

254681eeafadadd1580b3169d3fec973

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

ws2_32

Exports

Exports

Sections

.text Size: 175KB - Virtual size: 175KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 175KB - Virtual size: 175KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 11KB - Virtual size: 10KB