ac420d48bf32ba7e942b81c5c278bb249d0a816ef3e9e8a8fb70f018bc9f70d6N

Sharing

Copy URL Twitter E-mail

General

Target

ac420d48bf32ba7e942b81c5c278bb249d0a816ef3e9e8a8fb70f018bc9f70d6N
Size

2.9MB
MD5

8e3e142a6155e68aa736ee70fb362da0
SHA1

dabf49ac9edcad87e2311a66da9420c0cf97309b
SHA256

ac420d48bf32ba7e942b81c5c278bb249d0a816ef3e9e8a8fb70f018bc9f70d6
SHA512

c7e17bdc342a5e418105e734662a9c266520fd3a9b9d0548e1afca1105e49a93101fb8e8e56f436eb54df7c659d54225690faeba31046d910278363742ee9c6c
SSDEEP

49152:4C54XwXQG5tncw+IwF3c+RmIQRdKL7/MuS+v6jmHZ:464SQGPncwlws+o7tu+jmH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac420d48bf32ba7e942b81c5c278bb249d0a816ef3e9e8a8fb70f018bc9f70d6N

Files

ac420d48bf32ba7e942b81c5c278bb249d0a816ef3e9e8a8fb70f018bc9f70d6N
.dll windows:5 windows x86 arch:x86

558fe53b12dfbbd8bdf6c7f59310fe1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

K:\XSu\Bm.pdb

Imports

gdi32

MoveToEx
SetMetaRgn
ModifyWorldTransform

user32

IsCharLowerA
GetUpdateRgn
SwitchDesktop

kernel32

SetStdHandle
EnterCriticalSection
QueryPerformanceCounter
GetModuleHandleA
OutputDebugStringA
LoadLibraryExA
GetModuleFileNameW
GetProcessVersion
LocalAlloc
IsValidCodePage
SetPriorityClass
CreateFileA
GetBinaryTypeW
LeaveCriticalSection
GetStdHandle
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
GetLastError
CompareStringW
Sleep
HeapFree
ExitProcess
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapAlloc
HeapReAlloc
VirtualFree
VirtualAlloc
GetModuleFileNameA
LoadLibraryA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CloseHandle

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA

wintrust

OpenPersonalTrustDBDialog

ole32

OleFlushClipboard

esent

JetSetColumn

Exports

Exports

KrfgooouteBe

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.EXP
Size: 4KB - Virtual size: 543B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

558fe53b12dfbbd8bdf6c7f59310fe1c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

kernel32

setupapi

wintrust

ole32

esent

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.EXP Size: 4KB - Virtual size: 543B

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 112KB - Virtual size: 119KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 56KB - Virtual size: 53KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.EXP
Size: 4KB - Virtual size: 543B

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 112KB - Virtual size: 119KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 56KB - Virtual size: 53KB