ldr_AcYylg8W[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ldr_AcYylg8W.exe
Size

19.0MB
MD5

30b4515fa20df6cf7de8fe24e696fcda
SHA1

794af0ec4e940b295585b53bdf64376cdf43e1ee
SHA256

b1a1599bcb318a415df8a9599ef8826cd231ab8f69fec6cb2a7dd736883fdfe0
SHA512

5d9d6abc9f85ccb5e6cf7c4d367aced6a3ab2d160ba2db3ab4a1990377209c637f9a27a23ffb1d8b59a4012bf2c3f608e8571390c291356b134f304835c6ce2d
SSDEEP

393216:S9DrgShrW9s8udCzZjL/V/1rPMaiz/4YSTjwwTZPWL4l8aXEZM:S9o7LV/VNrPiz/4PfwSSa6M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ldr_AcYylg8W.exe

Files

ldr_AcYylg8W.exe
.exe windows:6 windows x64 arch:x64

bd7d22263fa141e2b5b107ca6d0d179e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathFileExistsW

iphlpapi

SendARP

gdiplus

GdipAlloc

kernel32

GetVersion
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

ExitWindowsEx

gdi32

SelectObject

advapi32

OpenProcessToken

shell32

SHGetFolderPathW

ole32

CreateStreamOnHGlobal

ntdll

RtlVirtualUnwind

ws2_32

inet_pton

dbghelp

SymGetTypeInfo

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateContext

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.,"&
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.]:q
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.D7D
Size: 19.0MB - Virtual size: 19.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd7d22263fa141e2b5b107ca6d0d179e

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

iphlpapi

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

ntdll

ws2_32

dbghelp

bcrypt

crypt32

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 559KB

.data Size: - Virtual size: 118KB

.pdata Size: - Virtual size: 53KB

.detourc Size: - Virtual size: 8KB

.detourd Size: - Virtual size: 24B

.,"& Size: - Virtual size: 11.8MB

.]:q Size: 4KB - Virtual size: 4KB

.D7D Size: 19.0MB - Virtual size: 19.0MB

.reloc Size: 512B - Virtual size: 56B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 559KB

.data
Size: - Virtual size: 118KB

.pdata
Size: - Virtual size: 53KB

.detourc
Size: - Virtual size: 8KB

.detourd
Size: - Virtual size: 24B

.,"&
Size: - Virtual size: 11.8MB

.]:q
Size: 4KB - Virtual size: 4KB

.D7D
Size: 19.0MB - Virtual size: 19.0MB

.reloc
Size: 512B - Virtual size: 56B

.rsrc
Size: 512B - Virtual size: 480B