4965abd48046a17ef4641ac05b3410096907e51b20da596f44824f872ead28fc

Sharing

Copy URL Twitter E-mail

General

Target

4965abd48046a17ef4641ac05b3410096907e51b20da596f44824f872ead28fc
Size

2.5MB
MD5

043f65460e7ef9af966f3a0d3dc1938d
SHA1

7ab3a88cfd47b81df63b2fc4f18692611f0b466e
SHA256

4965abd48046a17ef4641ac05b3410096907e51b20da596f44824f872ead28fc
SHA512

aa5de1545a612612bf566deb940707cfac26f4a75c68e62d553d54fd29086c9761746aeaf3eaf229fb2336b21641ba9b3382d69e82f10d5ab6f710a65ee41b45
SSDEEP

49152:3kZizCC1FC5eYxdWaD4Orf50a7W5Yluc194ueg1uRBqI+wvbvGjSwzFob3Ei:0U+vzrjDJrf57yfc/kg1unJvbvASwz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4965abd48046a17ef4641ac05b3410096907e51b20da596f44824f872ead28fc

Files

4965abd48046a17ef4641ac05b3410096907e51b20da596f44824f872ead28fc
.dll windows:5 windows x86 arch:x86

b11759d1c612de1cfeaa035850b82341

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoWaitForMultipleHandles

setupapi

SetupScanFileQueueW

advapi32

NotifyBootConfigStatus

kernel32

MultiByteToWideChar
FlushFileBuffers
SetCurrentDirectoryW
GetFullPathNameW
GetModuleHandleA
GetModuleFileNameA
GetModuleFileNameW
DuplicateHandle
GlobalDeleteAtom
GetSystemDefaultUILanguage
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
DeleteCriticalSection
Sleep
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
ExitProcess
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
VirtualFree
VirtualAlloc
WriteFile
LoadLibraryA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA

Exports

Exports

EhckewmiraarldeQnd

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_MEM_READ

.data
Size: 304KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qdata
Size: 692KB - Virtual size: 690KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b11759d1c612de1cfeaa035850b82341

Headers

DLL Characteristics

File Characteristics

Imports

ole32

setupapi

advapi32

kernel32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 304KB - Virtual size: 314KB

.qdata Size: 692KB - Virtual size: 690KB

.rsrc Size: 40KB - Virtual size: 38KB

.reloc Size: 52KB - Virtual size: 50KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 304KB - Virtual size: 314KB

.qdata
Size: 692KB - Virtual size: 690KB

.rsrc
Size: 40KB - Virtual size: 38KB

.reloc
Size: 52KB - Virtual size: 50KB