52dc6ecfd98683d07d17762aa48a43785ce75474477c21fb707042c62310e744

Sharing

Copy URL Twitter E-mail

General

Target

52dc6ecfd98683d07d17762aa48a43785ce75474477c21fb707042c62310e744
Size

4.1MB
MD5

09239862d45f97e94dc3130ed07b2e15
SHA1

0fe0a6679f80021a2e409a6f4422fb4f6c68f0db
SHA256

52dc6ecfd98683d07d17762aa48a43785ce75474477c21fb707042c62310e744
SHA512

266cf850eaaa98051d16cb08e164889efd4e12b3624d37a22c8e9fa47f860ce4cd90538102fea67460029696d94fe0011184584fc2c2784b7ca6d55da1c6165f
SSDEEP

98304:WSslxYl+lseULyuKu5IhOtJs0gm5Duw9i:crW+FBuT5IhIu0F5Duw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52dc6ecfd98683d07d17762aa48a43785ce75474477c21fb707042c62310e744

Files

52dc6ecfd98683d07d17762aa48a43785ce75474477c21fb707042c62310e744
.dll windows:6 windows x86 arch:x86

ad6e606af4fa661882629992acffbef3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
OpenMutexA
CloseHandle
LocalFree
WideCharToMultiByte
HeapFree
LocalAlloc
HeapAlloc
GetProcessHeap
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32Next
lstrcmpiA
WriteProcessMemory
GetModuleHandleA
GetProcAddress
VirtualAllocEx
GetModuleHandleW
CreateRemoteThread
ExitProcess
WriteConsoleW
CreateMutexA
FindClose
WriteFile
GetModuleFileNameA
HeapReAlloc
HeapSize
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
SetStdHandle
Process32First
CreateFileW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
DecodePointer
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer
RaiseException
InterlockedFlushSList
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
GetConsoleMode
LCMapStringW

advapi32

OpenProcessToken
InitializeSecurityDescriptor
GetSidSubAuthorityCount
GetSidSubAuthority
LookupAccountSidA
GetTokenInformation
SetSecurityDescriptorDacl

wtsapi32

WTSEnumerateProcessesA
WTSFreeMemory

ntdll

RtlAdjustPrivilege
ZwAllocateVirtualMemory
ZwQueryInformationProcess
ZwDuplicateObject
ZwFreeVirtualMemory
ZwClose
ZwOpenProcess
ZwQuerySystemInformation

Exports

Exports

EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad6e606af4fa661882629992acffbef3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

wtsapi32

ntdll

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 2KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 256B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 256B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 4KB