36de4d3768cc0c341d7d5561f01393db5f6188b7cbd3ab6ed13ac33c3f672354

Sharing

Copy URL Twitter E-mail

General

Target

36de4d3768cc0c341d7d5561f01393db5f6188b7cbd3ab6ed13ac33c3f672354
Size

377KB
MD5

0f1837dac24736b6b8f373ef91a4c8b0
SHA1

c1f93166da867a7e7e7f9fb799c669268cd0d1e2
SHA256

36de4d3768cc0c341d7d5561f01393db5f6188b7cbd3ab6ed13ac33c3f672354
SHA512

60796b921453d239c04fca06fcc728d14b9612a316b58d7ceaa0943f5603dd5460bc8c6f8b7a742e769d66592a6ee7b67a8f8ff7bfac4a162bf25df0300f252a
SSDEEP

6144:Uz1qemOuDvEfDXiVqRkuXYB9ZF9VHNnQXjJQ+TDF05ZBlfgeS82OA4V4jFMf:Y1qemOuDGyVruXYB9ZF9U9Qg05ZLfgPc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36de4d3768cc0c341d7d5561f01393db5f6188b7cbd3ab6ed13ac33c3f672354

Files

36de4d3768cc0c341d7d5561f01393db5f6188b7cbd3ab6ed13ac33c3f672354
.dll windows:5 windows x86 arch:x86

888cced38c582aa1abab1a7890687e38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\po\trunk\modules\backup\Release\backup32.pdb

Imports

kernel32

GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
DeleteFileA
GetTempPathA
GetModuleFileNameA
GetVolumeInformationW
DebugBreak
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
DisableThreadLibraryCalls
lstrcmpA
ReadFile
GetDriveTypeA
SetFilePointer
GetFileSize
CreateThread
lstrcpyW
DeleteFileW
CloseHandle
GetDiskFreeSpaceExW
DeleteCriticalSection
CreateIoCompletionPort
lstrcmpiW
GetLocalTime
EnterCriticalSection
lstrlenW
CreateFileW
lstrcpynW
LeaveCriticalSection
CreateEventA
CopyFileW
Sleep
InitializeCriticalSection
OutputDebugStringW
GetWindowsDirectoryW
GetFileTime
SetFileTime
lstrcpyA
Module32NextW
OpenEventW
GetFileAttributesExW
CreateToolhelp32Snapshot
FindNextFileW
GetWindowsDirectoryA
ReadDirectoryChangesW
GetLogicalDrives
SetEvent
WaitForSingleObject
GetQueuedCompletionStatus
GetDriveTypeW
GetModuleHandleA
Module32FirstW
DeviceIoControl
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
WriteFile
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
CreateFileA
FindFirstFileW
lstrlenA
VirtualQuery
lstrcpynA
SetEndOfFile
SystemTimeToFileTime
GetFileAttributesW
GetModuleFileNameW
lstrcmpW
GetCurrentDirectoryW
FindClose
WriteConsoleW

shell32

SHGetSpecialFolderPathW
ord165

ole32

CoInitialize
CoCreateGuid

shlwapi

wnsprintfW
StrCmpNIW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathAddBackslashW
StrStrIW
SHDeleteValueW
PathFileExistsW
PathAppendW
StrCmpNW
PathMatchSpecW
PathRemoveBackslashW
PathFileExistsA
PathAppendA
wvnsprintfW
SHGetValueA
SHSetValueW
StrChrA
wnsprintfA
wvnsprintfA
SHCreateStreamOnFileW
SHGetValueW
StrChrW
PathRemoveFileSpecW

libcurl32

curl_slist_append
curl_free
curl_easy_setopt
curl_easy_perform
curl_easy_strerror
curl_easy_cleanup
curl_global_init
curl_easy_escape
curl_easy_getinfo
curl_easy_reset
curl_easy_init
curl_slist_free_all
curl_formfree
curl_formadd

advapi32

RegOpenKeyExW
GetUserNameW
RegCloseKey
RegEnumValueW

Sections

.text
Size: 282KB - Virtual size: 281KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

888cced38c582aa1abab1a7890687e38

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

ole32

shlwapi

libcurl32

advapi32

Sections

.text Size: 282KB - Virtual size: 281KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 13KB - Virtual size: 24KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 282KB - Virtual size: 281KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 13KB - Virtual size: 24KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 22KB