15299b6896b35eac2605180781510d767eb90ff18d3cfa19f3c8d4e5476549bc

Sharing

Copy URL Twitter E-mail

General

Target

15299b6896b35eac2605180781510d767eb90ff18d3cfa19f3c8d4e5476549bc
Size

231KB
MD5

764c7b0cdc8a844dc58644a32773990e
SHA1

cff4c1cfa65dc11f1849dc94ef090d56021d9fbd
SHA256

15299b6896b35eac2605180781510d767eb90ff18d3cfa19f3c8d4e5476549bc
SHA512

fd47417ac6bd42828dc1240bc32ead3dbce8395820a4f5d4759f5cf0fc38bb4e2d0ec1b0f1b78c62619cc90b18db44b1ce6598b33660e35b059954a9baf694d1
SSDEEP

6144:EEoexuiVDbqMTxNtz7P888fIDrE2kO8c0LpEC21RQ1:EEoEuiVykxNl7Pz87g8cAneRQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15299b6896b35eac2605180781510d767eb90ff18d3cfa19f3c8d4e5476549bc

Files

15299b6896b35eac2605180781510d767eb90ff18d3cfa19f3c8d4e5476549bc
.dll windows:5 windows x86 arch:x86

2786d91611245072c0be19b8a49648b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
lstrlenW
GetLastError
MoveFileW
WriteFile
DeleteFileW
SetFileAttributesW
ExpandEnvironmentStringsW
WaitForSingleObject
CreateDirectoryW
InterlockedDecrement
SetErrorMode
CloseHandle
CreateMutexW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
GetModuleFileNameW
LocalFree
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcAddress
GetModuleHandleW
ExitProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapAlloc
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
WideCharToMultiByte
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringW
SetEnvironmentVariableW
LoadLibraryW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

ShellExecuteExW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

shlwapi

PathCombineW
PathFileExistsW
StrStrIW

Exports

Exports

f

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2786d91611245072c0be19b8a49648b4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 158KB - Virtual size: 166KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 158KB - Virtual size: 166KB

.reloc
Size: 6KB - Virtual size: 5KB