ce850be11349e8b4ffa6f3398694e43584f9f05b6789e9ab5b12e72ad03fcc81

Sharing

Copy URL Twitter E-mail

General

Target

ce850be11349e8b4ffa6f3398694e43584f9f05b6789e9ab5b12e72ad03fcc81
Size

10.0MB
MD5

a3426fcd5e1af73b9eb09ef82d7f9129
SHA1

eb94b040149a0aa29442c748a6b4dde7c90d9fdd
SHA256

ce850be11349e8b4ffa6f3398694e43584f9f05b6789e9ab5b12e72ad03fcc81
SHA512

609ea8e02dca59be9b2ebc4e8c4ca5c30c7a1b9e79b7a65912a491304f3be5023e470cad1f2109f45df87f1e5b1ee9fa973212fe5d24d9ba302d55a9a31a9769
SSDEEP

384:5Z5A3n6VkiMir8Mpat+kbFmnLGUI6rp1XJK3O368vgRMWUWW:5Zcgktir3atUnyUIUK3O36BRe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce850be11349e8b4ffa6f3398694e43584f9f05b6789e9ab5b12e72ad03fcc81

Files

ce850be11349e8b4ffa6f3398694e43584f9f05b6789e9ab5b12e72ad03fcc81
.dll windows:6 windows x64 arch:x64

6e47a7d45ef7bc999b128e052f7dc39d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

srand
rand
strcpy_s
strcat_s
_beginthreadex
wcscpy_s
wcscat_s
free
strchr
vsprintf_s
malloc
sprintf_s
ftell
fclose
fseek
fopen_s
fread
memcpy
memset

kernel32

SetLastError
IsBadReadPtr
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualProtect
lstrcpyA
GetSystemDirectoryA
MultiByteToWideChar
lstrcatA
GetTickCount
CreateEventA
FlushInstructionCache
GetCurrentProcessId
CreateFileMappingA
GetProcAddress
CreateThread
CloseHandle
GetModuleFileNameA
GetCurrentProcess
CreateMutexA
GetCurrentThreadId
GetModuleHandleA
Sleep
SetEvent

user32

ActivateKeyboardLayout
SetPropA
DispatchMessageA
LoadCursorA
SetWindowLongPtrW
MsgWaitForMultipleObjects
GetWindowLongPtrW
SetTimer
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
PeekMessageA
GetWindowLongPtrA
KillTimer
IsWindowUnicode
FindWindowA
RegisterClassExA
SetWindowLongPtrA

Exports

Exports

CandWndProc
CompWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e47a7d45ef7bc999b128e052f7dc39d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 684B

.rsrc Size: 1024B - Virtual size: 528B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 684B

.rsrc
Size: 1024B - Virtual size: 528B