8f1692ac469dc48fbe140e8dec1b9943a99934eeac35148b5c836a3b1c899706

Sharing

Copy URL Twitter E-mail

General

Target

8f1692ac469dc48fbe140e8dec1b9943a99934eeac35148b5c836a3b1c899706
Size

409KB
MD5

2a264cafc4d4583cf0ad68f5d9540b67
SHA1

8d83f1b29c156375575fddc546c77e711d4c5056
SHA256

8f1692ac469dc48fbe140e8dec1b9943a99934eeac35148b5c836a3b1c899706
SHA512

5d0ebf4e4a7cf70edd42fbd700a1f914956138e99a8eb5abca9d21fdf77b454b9c597d5a106e010d5aab74aebb56d74f9fbc631f36e52f7f2cd39d3e64fef8f4
SSDEEP

1536:xsmcjLC6ZRY5EP7jWkds4ZyrP53W6ffTiwiUA:xsmcj5D7s44NW6ffTRrA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f1692ac469dc48fbe140e8dec1b9943a99934eeac35148b5c836a3b1c899706

Files

8f1692ac469dc48fbe140e8dec1b9943a99934eeac35148b5c836a3b1c899706
.dll windows:5 windows x86 arch:x86

719b55ae80f3361b75af6e1900fcc8ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
FreeLibrary
GetProcAddress
VirtualAlloc
LoadLibraryA
VirtualProtect
GetNativeSystemInfo
CreateThread
DeleteFileW
CloseHandle
IsDebuggerPresent
GetLastError
CreateFileW
GetModuleFileNameW
Sleep
CreateMutexW
GetFileSize
SetLastError
ExitProcess
EncodePointer
DecodePointer
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
WriteFile
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize
MultiByteToWideChar
ReadFile
RaiseException
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
SetFilePointer
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
SetEndOfFile
WriteConsoleW
VirtualQuery

advapi32

RegSetValueExW
RegCloseKey
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
RegQueryValueExW
CryptReleaseContext
RegCreateKeyW
CryptDeriveKey
CryptAcquireContextW
CryptHashData

Exports

Exports

TmDbgInitialize
TmDbgTrace
TmDbgUninitialize

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

719b55ae80f3361b75af6e1900fcc8ad

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 17KB - Virtual size: 26KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 5KB

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 17KB - Virtual size: 26KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 5KB

.shell
Size: 320KB - Virtual size: 320KB