d09f0c77e8664d7bfa49d6849729af21783b9ce5472ecf63ea135744a1fae5fc

Sharing

Copy URL Twitter E-mail

General

Target

d09f0c77e8664d7bfa49d6849729af21783b9ce5472ecf63ea135744a1fae5fc
Size

392KB
MD5

9f78d17990e532117bba1f5458e0eb29
SHA1

7f1871d19f4b4c050383aa8ffeff97a68b4488ec
SHA256

d09f0c77e8664d7bfa49d6849729af21783b9ce5472ecf63ea135744a1fae5fc
SHA512

a05657bbbfa707bf7e8738ce8a63dd1ba67c3fbe096088193fe031748c4b9e2e5441783bed46e4b587c84819c33ced57b9c7d8bf896a0113b6cf8cf1f3f1824f
SSDEEP

1536:FkFTTmThKuJekEEOegbe8l8RM0jNsykyjEos:FkBEJyEpoloM36Eos

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d09f0c77e8664d7bfa49d6849729af21783b9ce5472ecf63ea135744a1fae5fc

Files

d09f0c77e8664d7bfa49d6849729af21783b9ce5472ecf63ea135744a1fae5fc
.dll windows:5 windows x86 arch:x86

d61dfe99bd46e43adc3ec42f381d817d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
CreateFileA
GetProcAddress
LoadLibraryA
GetLastError
CreateMutexA
OpenProcess
GetCurrentProcessId
GetWindowsDirectoryA
WriteFile
MultiByteToWideChar
ReadFile
WaitForSingleObject
CreateProcessA
WideCharToMultiByte
DeleteFileA
GetSystemDirectoryA
GetVersionExA
GetOEMCP
GetFileSize
CloseHandle
VirtualAlloc
CreateFileW
GetStringTypeW
LCMapStringW
GetProcessHeap
SetEndOfFile
WriteConsoleW
HeapReAlloc
LoadLibraryW
IsValidCodePage
GetACP
GetCPInfo
GetModuleFileNameW
HeapSize
VirtualFree
ExitThread
GetCurrentThreadId
CreateThread
GetFileAttributesA
DecodePointer
GetCommandLineA
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RaiseException
InitializeCriticalSectionAndSpinCount
RtlUnwind
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
SetFilePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers

user32

CharLowerA

advapi32

GetUserNameA

wininet

HttpOpenRequestA
InternetReadFile
HttpSendRequestA
InternetCloseHandle
InternetQueryOptionA
HttpAddRequestHeadersA
InternetOpenA
InternetConnectA

psapi

EnumProcessModules
GetModuleBaseNameA

ws2_32

WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup

Exports

Exports

myfuc

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d61dfe99bd46e43adc3ec42f381d817d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

wininet

psapi

ws2_32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 5KB - Virtual size: 21KB

.reloc Size: 5KB - Virtual size: 5KB

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 5KB - Virtual size: 21KB

.reloc
Size: 5KB - Virtual size: 5KB

.shell
Size: 320KB - Virtual size: 320KB