15eb0cc652f7e23cdf326fa024d80271

Sharing

Copy URL

Twitter E-mail

General

Target

15eb0cc652f7e23cdf326fa024d80271
Size

837KB
MD5

15eb0cc652f7e23cdf326fa024d80271
SHA1

1c1d2bb75479a66aacde6ec958db888253241166
SHA256

988565f1618eafa7a7447b3c3b1785d07bfde0db37e0da3ee11de1a1ebf09725
SHA512

0c1077a6120ddb2f84759e74e3551a6aa76ab2834ce9696e2a78c8b6e53177efb945c1ac10927a9cec4313a53dd5d6c1068c6534bdbbf733d9e9ed1e91c29f73
SSDEEP

24576:a/XAENYg+es34eRUhLAjazqUfzySmTurz4:vE+es3/Rst9sir

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15eb0cc652f7e23cdf326fa024d80271

Files

15eb0cc652f7e23cdf326fa024d80271
.dll windows:5 windows x64 arch:x64

ebd46ca04f46b89c83932bf0711d2041

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

UnmapViewOfFile
OpenProcess
CreateToolhelp32Snapshot
Process32Next
HeapReAlloc
CloseHandle
GetCurrentProcessId
WideCharToMultiByte
OpenFileMappingA
MapViewOfFile
lstrlenA
CopyFileA
GetLastError
TerminateProcess
ReadFile
FindFirstFileA
FindNextFileA
FindClose
CreateFileA
GetFileSize
lstrlenW
MultiByteToWideChar
GetTempPathA
GetConsoleCP
SetStdHandle
Process32First
lstrcpyW
LocalFree
lstrcpyA
lstrcatA
FreeLibrary
GetProcessHeap
GetProcAddress
HeapAlloc
LoadLibraryA
DeleteFileA
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
HeapValidate
HeapSize
Sleep
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCurrentProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
SetFilePointerEx
GetConsoleMode
GetStdHandle
GetFileType
GetStringTypeW
GetACP
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW

user32

wsprintfW
wsprintfA

advapi32

RegQueryValueExA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExA
CryptAcquireContextA

shell32

SHGetFolderPathA

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance

bcrypt

BCryptGetProperty
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptGenerateSymmetricKey

shlwapi

StrStrIA
SHGetValueA
StrToIntA
StrChrA
StrStrIW

Sections

.text
Size: 652KB - Virtual size: 652KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

bss
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebd46ca04f46b89c83932bf0711d2041

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

bcrypt

shlwapi

Sections

.text Size: 652KB - Virtual size: 652KB

bss Size: 4KB - Virtual size: 4KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 24KB - Virtual size: 24KB

.pdata Size: 24KB - Virtual size: 24KB

.gfids Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 652KB - Virtual size: 652KB

bss
Size: 4KB - Virtual size: 4KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 24KB - Virtual size: 24KB

.pdata
Size: 24KB - Virtual size: 24KB

.gfids
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB