5ebe93ffd5359b09f31e63be4e531ec72002874c5edb53b936f0e2879ff0ad4c

Sharing

Copy URL

Twitter E-mail

General

Target

5ebe93ffd5359b09f31e63be4e531ec72002874c5edb53b936f0e2879ff0ad4c
Size

427KB
MD5

a11f717d224a2f229309c6b782e6810f
SHA1

4e97c89baf50699d2f49a296fd32847a2e11b1dc
SHA256

5ebe93ffd5359b09f31e63be4e531ec72002874c5edb53b936f0e2879ff0ad4c
SHA512

da1cba063eb02b36a5a77d9a338de29940bdfa866f37b2c8daf4ffc0aa2e139ed3a7643a1dd61e35e04c278574a13c29ee6d758a76f82b23a38452d3c3f1615b
SSDEEP

1536:1oc54q3DWrYOBvnXzyTn25XZKz6ctkzIph3wessmPr1if/959M:1T54Wed7AzKJessmk959

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5ebe93ffd5359b09f31e63be4e531ec72002874c5edb53b936f0e2879ff0ad4c

Files

5ebe93ffd5359b09f31e63be4e531ec72002874c5edb53b936f0e2879ff0ad4c
.dll windows:5 windows x86 arch:x86

b136e601b93c43612bff8d453c67c0f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

wsprintfA
EnumChildWindows
GetWindow
PostMessageA
GetWindowThreadProcessId

shell32

SHGetSpecialFolderPathA

advapi32

OpenProcessToken
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA

kernel32

SetHandleCount
GetModuleFileNameA
CreateThread
GetComputerNameA
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
GetLastError
CloseHandle
lstrcatA
GetShortPathNameA
GetTempPathA
WinExec
GetLocalTime
CreateMutexA
Sleep
FreeLibrary
DeleteFileA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
ExitProcess
WriteFile
SetStdHandle
SetFilePointer
MultiByteToWideChar
ReadFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

ExportFunction

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.shell
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b136e601b93c43612bff8d453c67c0f2

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 17KB

.reloc Size: 7KB - Virtual size: 7KB

.shell Size: 320KB - Virtual size: 320KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 17KB

.reloc
Size: 7KB - Virtual size: 7KB

.shell
Size: 320KB - Virtual size: 320KB