bfccb2cd889ae72dcdedabd07132af6f89bfde91fbf905ec547e1b3d4926ac9e

Sharing

Copy URL Twitter E-mail

General

Target

bfccb2cd889ae72dcdedabd07132af6f89bfde91fbf905ec547e1b3d4926ac9e
Size

1.6MB
MD5

3521237097456e0b98ae64968e698573
SHA1

c6964e7b002225733e99f7160a874ce993afac91
SHA256

bfccb2cd889ae72dcdedabd07132af6f89bfde91fbf905ec547e1b3d4926ac9e
SHA512

db9916bc9e454231833a28e754aba7be9571fc7b48ec456f317b5b4e428856cf6fa0380c2213beb0450ec86633be2398a1d72d781f294f100b4f9f2d98ee4bf2
SSDEEP

49152:EvSwrEYAwtRS/QS+HGNLgsJKsRWkNymGJ9YoebLxJJkJh:CSwlAo/scsJYkMmtogLxTkL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfccb2cd889ae72dcdedabd07132af6f89bfde91fbf905ec547e1b3d4926ac9e

Files

bfccb2cd889ae72dcdedabd07132af6f89bfde91fbf905ec547e1b3d4926ac9e
.dll windows:6 windows x86 arch:x86

40c4b209cb7e78b6ce608788a665a705

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

d3d9

Direct3DCreate9

kernel32

LocalAlloc

user32

CallWindowProcW

gdi32

GetDeviceCaps

advapi32

QueryServiceConfigW

shell32

ShellExecuteW

msvcp140

?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

iphlpapi

GetTcpTable2

ws2_32

getpeername

d3dx9_43

D3DXCreateTextureFromFileExA

netapi32

Netbios

imm32

ImmGetContext

vcruntime140

memcmp

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

iswalnum

api-ms-win-crt-stdio-l1-1-0

ungetc

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

atan2

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-convert-l1-1-0

mbstowcs

api-ms-win-crt-utility-l1-1-0

rand

msvcrt

strncpy

psapi

GetMappedFileNameW

Exports

Exports

Direct3DCreate8

Sections

.text
Size: 726KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KO2_0_P
Size: 894KB - Virtual size: 896KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.KO2_0_P
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40c4b209cb7e78b6ce608788a665a705

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

kernel32

user32

gdi32

advapi32

shell32

msvcp140

iphlpapi

ws2_32

d3dx9_43

netapi32

imm32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

msvcrt

psapi

Exports

Exports

Sections

.text Size: 726KB - Virtual size: 2.0MB

.KO2_0_P Size: 894KB - Virtual size: 896KB

.idata Size: 2KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 4KB

.KO2_0_P Size: 4KB - Virtual size: 4KB

.text
Size: 726KB - Virtual size: 2.0MB

.KO2_0_P
Size: 894KB - Virtual size: 896KB

.idata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 4KB

.KO2_0_P
Size: 4KB - Virtual size: 4KB