0ead4022281c64eeaff0b33e74ee737e8f1a674aaa02149e9893e9639486f1b9

Sharing

Copy URL Twitter E-mail

General

Target

0ead4022281c64eeaff0b33e74ee737e8f1a674aaa02149e9893e9639486f1b9
Size

73KB
MD5

56354b65eb73292772eb11c24be8c5ae
SHA1

001305957e8552771546c08adf09722768d095e4
SHA256

0ead4022281c64eeaff0b33e74ee737e8f1a674aaa02149e9893e9639486f1b9
SHA512

7ace0e46044befc6ec74fb567ea8fe8409b806d050cdab592a30d7c876f9d61163cd9bc37b3ee2470240b878307931d83bc9b0bc31ecc54420657ad42325db52
SSDEEP

768:e9fYAQdXKWFPFDJMlz0Uv9+RofQvVyT2i53/eHlxjy0TlN7fkg5MW6Syn5yZWmDr:e5YA3tYnA6s/uPfR5AJ5UWmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ead4022281c64eeaff0b33e74ee737e8f1a674aaa02149e9893e9639486f1b9

Files

0ead4022281c64eeaff0b33e74ee737e8f1a674aaa02149e9893e9639486f1b9
.dll windows:5 windows x86 arch:x86

142568d532ea2e3d7bfc2877856d07e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

psapi

EnumProcessModules

shlwapi

PathAppendA
PathFindFileNameA

kernel32

CreateFileA
FindClose
FindNextFileA
FindFirstFileA
GetSystemDirectoryA
GetModuleFileNameA
GetCurrentProcess
GetProcAddress
LoadLibraryA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
LCMapStringA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
HeapSize
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount

advapi32

GetUserNameA

Exports

Exports

checkpro

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

142568d532ea2e3d7bfc2877856d07e5

Headers

File Characteristics

Imports

psapi

shlwapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 6KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 6KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 5KB