d8565b439b0068e821f25c583e3d87eb86d32ef0bc967445fd238cc34ea3ba11

Sharing

Copy URL

Twitter E-mail

General

Target

d8565b439b0068e821f25c583e3d87eb86d32ef0bc967445fd238cc34ea3ba11
Size

86KB
MD5

e03642c4b396dfeb52fb1b498475b055
SHA1

33fe791260e01de66eb56208b7f076407fd30bd7
SHA256

d8565b439b0068e821f25c583e3d87eb86d32ef0bc967445fd238cc34ea3ba11
SHA512

3eb523dd3baea862d7501157159c4a1024b26c8c65917d6c96a03ea0eda9ff3da301a68409cf74227412afadbcd1cfee2f103cc72a0f50e107485cacace11937
SSDEEP

768:ajdd4XidkFAupmuMm4Y1NV/GjhyNuSUxMY844o4iJ/X+/8Oc/f6nxLQB:Vyux0hM3/8+n1QB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8565b439b0068e821f25c583e3d87eb86d32ef0bc967445fd238cc34ea3ba11

Files

d8565b439b0068e821f25c583e3d87eb86d32ef0bc967445fd238cc34ea3ba11
.exe windows:5 windows x86 arch:x86

27c0702f08b2a89f3ff0244d8d47111b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
lstrcmpiW
SetConsoleMode
GetConsoleMode
GetFileType
GetStdHandle
GetProcAddress
GetModuleHandleA
GetLastError
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetDateFormatW
GetTimeFormatW
GetModuleHandleW
MultiByteToWideChar
lstrlenW
WriteConsoleW
GetConsoleOutputCP
WideCharToMultiByte
QueryPerformanceCounter
FormatMessageW

msvcrt

wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
fgetwc
_wsetlocale
_c_exit
_exit
_XcptFilter
_cexit
exit
__winitenv
_iob
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
fflush
_wspawnl
_errno
time
wcslen
wprintf
printf
wcsncpy
wcspbrk
_tzset
localtime
_vsnwprintf
wcschr
_wcsicmp
_wtoi
__wgetmainargs

advapi32

ReadEventLogW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
CloseEventLog
OpenEventLogW

ws2_32

inet_ntoa
WSAGetLastError
inet_addr

ole32

CLSIDFromString

wlbsctrl

WlbsDrainStop
WlbsResume
WlbsSuspend
WlbsStop
WlbsStart
WlbsQuery
WlbsPortSet
WlbsPasswordSet
WlbsEnable
WlbsEnumClusters
WlbsInit
WlbsNotifyConfigChange
WlbsWriteReg
WlbsReadReg
WlbsAddressToString
WlbsResolve
WlbsDisable
WlbsQueryState
WlbsDrain

Exports

Exports

??4WLBS_REG_PARAMS@@QAEAAU0@ABU0@@Z

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

27c0702f08b2a89f3ff0244d8d47111b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

ws2_32

ole32

wlbsctrl

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 29KB

.rsrc Size: 60KB - Virtual size: 124KB

.text
Size: 24KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 29KB

.rsrc
Size: 60KB - Virtual size: 124KB