e813b0b36bee2c7c850be3f22ee76bbc5a481e1c6c66db4aae61139619cae2bc

Sharing

Copy URL Twitter E-mail

General

Target

e813b0b36bee2c7c850be3f22ee76bbc5a481e1c6c66db4aae61139619cae2bc
Size

1.7MB
MD5

a2d210b8caa0f4eebf1309142540411e
SHA1

bff6b703d541f89907c0f0bb53730df01a1515f9
SHA256

e813b0b36bee2c7c850be3f22ee76bbc5a481e1c6c66db4aae61139619cae2bc
SHA512

01760b7c0c59026168b31219400715cb53dea6010f632477e4009b120f005ffc371e9ae9e09ac4fed6ea7dde59f6d5f48680ffc1a46e9147e810185174657c64
SSDEEP

49152:N0TF6Avh8GgeTqXgem+ZpCqy8bSQzoXMj2MBiCouxypSPpadHf:N0EAZ8faugDtucpqa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e813b0b36bee2c7c850be3f22ee76bbc5a481e1c6c66db4aae61139619cae2bc

Files

e813b0b36bee2c7c850be3f22ee76bbc5a481e1c6c66db4aae61139619cae2bc
.dll windows:5 windows x86 arch:x86

3cdec25f8dbf4111450aafcc8d4d122e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTimeZoneInformation
GetProcessHeap
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetEndOfFile
DecodePointer
GetModuleFileNameA
CreateFileA
CloseHandle
GetLocalTime
SetEnvironmentVariableA
GetCurrentProcessId
GetCommandLineA
GetCPInfo
GetOEMCP
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteFile
OutputDebugStringW
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
GetModuleHandleExW
DeleteFiber
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FreeLibrary
LoadLibraryA
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
RaiseException
GetModuleFileNameW
WriteConsoleW
ExitProcess
SetConsoleCtrlHandler
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapFree
GetACP
CompareStringW
LCMapStringW
GetStringTypeW
WaitForSingleObjectEx
CreateThread
HeapReAlloc
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindFirstFileExA
FindNextFileA
IsValidCodePage
ReadFile

ws2_32

closesocket
WSASetLastError
send
WSAGetLastError
WSACleanup
recv

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

shlwapi

PathAppendA
PathRemoveFileSpecA

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

advapi32

RegisterEventSourceW
DeregisterEventSource
CryptSetHashParam
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey

Exports

Exports

_getData@8
_getlist2@8
a1
akt
b15ykuj
b5yku3
bbcc
c3b
dg
dz
ecmb7
eebb5
eeff
em5l
enb4u
enk4e9
fac
fce
fd1
fenk4
fenk4g9
ffmm5
fomaq
fst
gek49
getDescription
getErrorMessage
getResult
getVersion
getWarnMsg
getWarnTime
getlist
ggkk5
grkc8
grkc9
gyam8rx
hasInterference
hhmm
hhmm5
hlichlp
hnym5
hqbjo
hqbju
hqnju
initData
ipbwm
kml
krty9
lkm
llrr
ma3t
mirys
ngeil
pbDispose
qc6b
rrgg
ry81x
rym81x
swfp1
swfpw1s
sz
veek8
vejk8
vlk7
vpctn
vvjj5
wtf8bp
xlislp
yphxn

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cdec25f8dbf4111450aafcc8d4d122e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

crypt32

shlwapi

user32

advapi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 403KB - Virtual size: 402KB

.data Size: 6KB - Virtual size: 19KB

.rsrc Size: 512B - Virtual size: 408B

.reloc Size: 46KB - Virtual size: 46KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 403KB - Virtual size: 402KB

.data
Size: 6KB - Virtual size: 19KB

.rsrc
Size: 512B - Virtual size: 408B

.reloc
Size: 46KB - Virtual size: 46KB