7345834832eacad72082bd1c5d6f4e5192ded7ac1772f35ebc92aa3a7157ef51

Sharing

Copy URL Twitter E-mail

General

Target

7345834832eacad72082bd1c5d6f4e5192ded7ac1772f35ebc92aa3a7157ef51
Size

22KB
MD5

a2a4f2387926bdeab133a017b707ae83
SHA1

503683e7b315406e406942555f1f593f3c100204
SHA256

7345834832eacad72082bd1c5d6f4e5192ded7ac1772f35ebc92aa3a7157ef51
SHA512

35ea9b2028e827ebc0dbc684ef7a586123c084b0663ff955a4f1c3908b44bce990bd6371a1a6b10b2460410b264855d06f5dc2d9c0c7b4bfc0391f9078e433d4
SSDEEP

384:h0h9SGuPHbHk23MajLnMXlItDBaVlZUpiR0OVzu+/vCEnxbTEK:h89SGuPHbHk23MmLnMXl4BcUpwVz1iER

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7345834832eacad72082bd1c5d6f4e5192ded7ac1772f35ebc92aa3a7157ef51

Files

7345834832eacad72082bd1c5d6f4e5192ded7ac1772f35ebc92aa3a7157ef51
.dll windows:6 windows x86 arch:x86

cde2e744f1bea8d3514c8a730ee0136f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\wtf\_x86\library.net\lib.k5.profile.dll:pdb

Imports

lib.posix

pthread_mutex_lock
pthread_mutex_destroy
link
asprintf
sync
pthread_mutex_unlock
getpwuid
pthread_mutex_init
getuid

lib.stdc

fclose
_assert
stat
access
fopen
rename
time
fcntl
_getstderr
strerror
strtol
strcasecmp
strncpy
strchr
isalnum
fgets
strncmp
fputs
feof
strlcpy
getThdErrno
unlink
fileno
abort
malloc
isspace
free
realloc
strdup
fprintf

system

?free@Heap@@SAXPAXI0I@Z
?copy@Mem@@SAXPBXPAXI@Z
?lock@InitCode@@SAXXZ
?unlock@InitCode@@SAXXZ

lib.k5.com_err

add_error_table

lib.k5.support

krb5int_open_plugin
k5_dir_filenames
krb5int_get_plugin_func
k5_clear_error
k5_path_join
krb5int_close_plugin
k5_free_filenames
k5_secure_getenv

Exports

Exports

et_prof_error_table
initialize_prof_error_table
profile_abandon
profile_add_relation
profile_clear_relation
profile_copy
profile_flush
profile_flush_to_buffer
profile_flush_to_file
profile_free_buffer
profile_free_list
profile_get_boolean
profile_get_integer
profile_get_relation_names
profile_get_string
profile_get_subsection_names
profile_get_values
profile_init
profile_init_flags
profile_init_path
profile_init_vtable
profile_iterator
profile_iterator_create
profile_iterator_free
profile_release
profile_release_string
profile_rename_section
profile_ser_externalize
profile_ser_internalize
profile_ser_size
profile_update_relation

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cde2e744f1bea8d3514c8a730ee0136f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

lib.posix

lib.stdc

system

lib.k5.com_err

lib.k5.support

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 32B

.reloc Size: 1024B - Virtual size: 684B

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 32B

.reloc
Size: 1024B - Virtual size: 684B