c50183eed715ec2392249e334940acf66315797a740a8fe782934352fed144c6

Sharing

Copy URL

Twitter E-mail

General

Target

c50183eed715ec2392249e334940acf66315797a740a8fe782934352fed144c6
Size

281KB
MD5

719a93419dd5123b52961a076d283f21
SHA1

835030d4709ef6a2a408d0a6d0fe59c0db228000
SHA256

c50183eed715ec2392249e334940acf66315797a740a8fe782934352fed144c6
SHA512

dc4b59ce5a4b8b2007049574ea65f59651669aff60fd5f44e7ddc700ec714eeb3b5c77407be56dbca536be9855eb1b4f82abac47c87712ace891c0c77357cddd
SSDEEP

6144:D4mXEU0AU8qYWi0BtNwG2xwC9VMEHka91rVUqS:DEUhWiqqGhs1O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c50183eed715ec2392249e334940acf66315797a740a8fe782934352fed144c6

Files

c50183eed715ec2392249e334940acf66315797a740a8fe782934352fed144c6
.dll windows:5 windows x86 arch:x86

fd3dbd431c841e102676ceab0d209962

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSADuplicateSocketA
closesocket
accept
select
__WSAFDIsSet
recv
send
WSAGetLastError
setsockopt
WSAStartup
WSASocketA
socket
inet_addr
htons
bind
listen

kernel32

TlsGetValue
Sleep
GetSystemTime
SetThreadPriority
TlsSetValue
GetCurrentThreadId
DuplicateHandle
GetCurrentThread
GetCurrentProcess
TlsAlloc
ResumeThread
UnmapViewOfFile
DeleteFileA
CreateDirectoryA
WriteFile
SetFileTime
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
SetErrorMode
GetLogicalDriveStringsA
GetComputerNameA
GetVersionExA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalDeleteAtom
GlobalAddAtomA
SystemTimeToFileTime
SetEvent
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
CloseHandle
MultiByteToWideChar
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleHandleA
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
RaiseException
HeapAlloc
HeapFree
GetEnvironmentStrings
ExitProcess
GetModuleHandleW
GetSystemTimeAsFileTime
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
CreateSemaphoreA
ReleaseSemaphore
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
CreateEventA
ExitThread
WaitForSingleObject
LoadLibraryA
GetProcAddress
FreeLibrary
GetLocaleInfoA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeA
GetStringTypeW
ReadFile

user32

GetUserObjectInformationA
MessageBeep
ExitWindowsEx
VkKeyScanA
GetAsyncKeyState
MapVirtualKeyA
RegisterWindowMessageA
PeekMessageA
WaitMessage
DispatchMessageA
EqualRect
GetForegroundWindow
WindowFromPoint
RegisterClassExA
CreateWindowExA
SetWindowLongA
SetClipboardViewer
GetClipboardOwner
GetClipboardData
DefWindowProcA
PostQuitMessage
GetWindowLongA
GetPropA
IsWindowVisible
SetPropA
RemovePropA
ChangeClipboardChain
DestroyWindow
SendMessageA
KillTimer
SetTimer
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DrawIconEx
LoadCursorA
ChangeDisplaySettingsA
OpenDesktopA
EnumDesktopWindows
SystemParametersInfoA
FindWindowA
GetClassNameA
PostMessageA
GetCursorPos
GetSystemMetrics
GetDesktopWindow
GetWindowRect
mouse_event
IsRectEmpty
IntersectRect
GetKeyboardState
keybd_event
EnumDisplaySettingsA
GetThreadDesktop
SetThreadDesktop
CloseDesktop
GetDC
ReleaseDC
SetRect
GetIconInfo
OpenInputDesktop
GetProcessWindowStation
EnumWindows

gdi32

DeleteDC
GetSystemPaletteEntries
DeleteObject
GetObjectA
GetBitmapBits
CreateDIBSection
ExtEscape
GdiFlush
GetStockObject
CombineRgn
CreateRectRgn
CreateRectRgnIndirect
GetRegionData
CreateDCA
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
RealizePalette
SelectPalette
BitBlt
SelectObject
CreatePalette

advapi32

RevertToSelf
ImpersonateLoggedOnUser
RegDeleteValueA
RegSetValueExA
RegCreateKeyA
RegCloseKey
GetUserNameA

Exports

Exports

?ReflectiveLoader@@YGKPAX@Z

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd3dbd431c841e102676ceab0d209962

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 13KB - Virtual size: 22KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 13KB - Virtual size: 22KB

.reloc
Size: 12KB - Virtual size: 11KB