fd30e407d03b0539caa9f5435aee65c6b260b7c508c1a1601f9c9e73cc88cabe

Sharing

Copy URL Twitter E-mail

General

Target

fd30e407d03b0539caa9f5435aee65c6b260b7c508c1a1601f9c9e73cc88cabe
Size

3.1MB
MD5

6c0aebbbc794918b02cdddd352fe898d
SHA1

8810c9fde3b49f05a82153709ba07af2235682c8
SHA256

fd30e407d03b0539caa9f5435aee65c6b260b7c508c1a1601f9c9e73cc88cabe
SHA512

9711e8902785ade55bf38f9a3e0f09f417061c521754396533d87c9dd781dfeefd78a666c63d2ddec642b9452f4445170d86db6ed3ec90fe76f96b8cdd93ca63
SSDEEP

49152:c6PSM67BCOm5FxZvw7Af7B+rIN6X0p20BCoKlgipHtTUyWa/pQ83L:c6S1+filtjR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd30e407d03b0539caa9f5435aee65c6b260b7c508c1a1601f9c9e73cc88cabe

Files

fd30e407d03b0539caa9f5435aee65c6b260b7c508c1a1601f9c9e73cc88cabe
.dll windows:6 windows x64 arch:x64

695e3fd1fabf32d73c5525df17994c27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\devadmmake\jenkins\build\workspace\BUX.daily.windows.build.V81\zBridge\target\blxmfes\Win7.vc2017-x64.Debug\lib\blxmfes.pdb

Imports

kernel32

GetFileAttributesExA
GetFileInformationByHandle
CloseHandle
GetLastError
CreateFileMappingA
ReOpenFile
FileTimeToSystemTime
Sleep
GetCurrentThread
SetThreadPriority
GetCurrentThreadId
FlushFileBuffers
LocalFree
FormatMessageA
SystemTimeToFileTime
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateThread
ExitThread
FreeLibrary
GetProcAddress
LoadLibraryA
SetFileAttributesW
GetSystemTime
CreateFileA
SetEndOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetConsoleCtrlHandler
WaitForSingleObjectEx
WriteConsoleW
OutputDebugStringW
OutputDebugStringA
HeapQueryInformation
HeapReAlloc
GetFileAttributesExW
MoveFileExW
GetACP
DeleteFileW
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CompareStringW
LCMapStringW
GetLocaleInfoW
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
GetFullPathNameA
ReadFile
SetStdHandle
ExitProcess
GetModuleHandleExW
GetTimeZoneInformation
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
HeapSize
HeapValidate
GetSystemInfo
GetModuleFileNameA
CreatePipe
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
ReadConsoleW
WriteFile
GetConsoleCP
DuplicateHandle
GetExitCodeProcess
CreateProcessA
CreateProcessW
GetDateFormatW
GetTimeFormatW
RtlUnwind

advapi32

GetUserNameA

ws2_32

listen
bind
accept
WSAStartup
freeaddrinfo
getaddrinfo
gethostname
WSAGetLastError
WSACleanup
socket
setsockopt
send
select
recv
ntohs
ntohl
htons
connect
closesocket
inet_ntop
inet_pton
htonl
shutdown

Exports

Exports

blx_api_process_data

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 545KB - Virtual size: 545KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

695e3fd1fabf32d73c5525df17994c27

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 545KB - Virtual size: 545KB

.data Size: 103KB - Virtual size: 152KB

.pdata Size: 95KB - Virtual size: 94KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 545KB - Virtual size: 545KB

.data
Size: 103KB - Virtual size: 152KB

.pdata
Size: 95KB - Virtual size: 94KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 12KB - Virtual size: 12KB