6f343ec98fc8746d39633d92bc3a9b9e56e86693a4b33028e8d15a4273b67848N

Sharing

Copy URL Twitter E-mail

General

Target

6f343ec98fc8746d39633d92bc3a9b9e56e86693a4b33028e8d15a4273b67848N
Size

389KB
MD5

433088a415db62b67a2e740fe86df920
SHA1

b46fd39534960e647d3d0466e3b95307898dec2a
SHA256

6f343ec98fc8746d39633d92bc3a9b9e56e86693a4b33028e8d15a4273b67848
SHA512

c9f81eab9f6818a55a43cc402ff529a6fc49055c13d048537b92af0cec1565f9b338a64074e823d24a548901ed0445c92ce1160aa452830a97748c74cafe497a
SSDEEP

12288:aDodqucqAFmyABXIENT0CJu7Me+/JQ8t21:/qucqfyAaIgN7Me1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/esent97.dll

Files

6f343ec98fc8746d39633d92bc3a9b9e56e86693a4b33028e8d15a4273b67848N
.cab
esent97.dll
.dll windows:4 windows x86 arch:x86

6e82bdee8ff6aafc7aa065dc48545f28

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
GetLastError
WaitForMultipleObjectsEx
SetEvent
VirtualFree
GetCurrentThreadId
VirtualAlloc
CreateEventA
CloseHandle
TerminateProcess
FreeLibrary
GetModuleHandleA
FlushFileBuffers
SetFilePointer
GetDriveTypeA
LeaveCriticalSection
EnterCriticalSection
DebugBreak
ReadProcessMemory
HeapAlloc
GetProcessHeap
HeapFree
TlsGetValue
WriteFile
lstrlenA
CreateFileA
GetVersionExA
TlsSetValue
DeleteCriticalSection
TlsFree
TlsAlloc
InitializeCriticalSection
GetSystemInfo
Sleep
QueryPerformanceCounter
IsProcessorFeaturePresent
QueryPerformanceFrequency
GetUserDefaultLangID
GlobalMemoryStatus
WaitForSingleObjectEx
SleepEx
SetThreadPriority
CreateThread
GetExitCodeThread
ExpandEnvironmentStringsA
lstrcmpA
lstrcpyA
HeapDestroy
UnhandledExceptionFilter
OutputDebugStringA
CreateSemaphoreA
GetLocalTime
CreateDirectoryA
RemoveDirectoryA
GetFileSize
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
SetEndOfFile
GlobalAlloc
ReadFileEx
WriteFileEx
GetOverlappedResult
MoveFileA
CopyFileA
GetDiskFreeSpaceA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
InterlockedIncrement
CreateMutexA
MapViewOfFile
CreateFileMappingA
GetCurrentProcessId
HeapCreate
GetTickCount
LoadLibraryA
ReleaseSemaphore
IsValidLocale
GetModuleFileNameA
GetProcAddress
VirtualQuery
GlobalFree
GetCurrentThread
GetCurrentProcess
GetSystemDefaultLangID
LCMapStringW
ReadFile

advapi32

DeregisterEventSource
InitializeSecurityDescriptor
ReportEventA
RegisterEventSourceA
SetSecurityDescriptorDacl
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA

msvcrt

free
malloc
memmove
_snprintf
strchr
_stricmp
sprintf
swprintf
_ltoa
_ftol
_purecall
printf
fflush
fprintf
fclose
fopen
_makepath
_splitpath
_fullpath
isprint
_iob
strtoul
vsprintf
strtok
_strnicmp
strpbrk
_except_handler3
rand
time
strncpy
_vsnprintf
atol
toupper
wcslen
_itoa
_ultoa
_strupr
__dllonexit
_onexit
_initterm
_adjust_fdiv
vprintf

Exports

Exports

JetAddColumn
JetAddColumn@28
JetAttachDatabase
JetAttachDatabase2
JetAttachDatabase2@16
JetAttachDatabase@12
JetBackup
JetBackup@12
JetBeginExternalBackup
JetBeginExternalBackup@4
JetBeginSession
JetBeginSession@16
JetBeginTransaction
JetBeginTransaction@4
JetCloseDatabase
JetCloseDatabase@12
JetCloseFile
JetCloseFile@4
JetCloseTable
JetCloseTable@8
JetCommitTransaction
JetCommitTransaction@8
JetCompact
JetCompact@24
JetComputeStats
JetComputeStats@8
JetConvertDDL
JetConvertDDL@20
JetCreateDatabase
JetCreateDatabase2
JetCreateDatabase2@20
JetCreateDatabase@20
JetCreateIndex
JetCreateIndex2
JetCreateIndex2@16
JetCreateIndex@28
JetCreateTable
JetCreateTable@24
JetCreateTableColumnIndex
JetCreateTableColumnIndex@12
JetDBUtilities
JetDBUtilities@4
JetDefragment
JetDefragment@24
JetDelete
JetDelete@8
JetDeleteColumn
JetDeleteColumn@12
JetDeleteIndex
JetDeleteIndex@12
JetDeleteTable
JetDeleteTable@12
JetDetachDatabase
JetDetachDatabase@8
JetDupCursor
JetDupCursor@16
JetDupSession
JetDupSession@8
JetEndExternalBackup
JetEndExternalBackup@0
JetEndSession
JetEndSession@8
JetEscrowUpdate
JetEscrowUpdate@36
JetExternalRestore
JetExternalRestore@32
JetGetAttachInfo
JetGetAttachInfo@12
JetGetBookmark
JetGetBookmark@20
JetGetChecksum
JetGetChecksum@12
JetGetColumnInfo
JetGetColumnInfo@28
JetGetCounter
JetGetCounter@12
JetGetCurrentIndex
JetGetCurrentIndex@16
JetGetCursorInfo
JetGetCursorInfo@20
JetGetDatabaseFileInfo
JetGetDatabaseFileInfo@16
JetGetDatabaseInfo
JetGetDatabaseInfo@20
JetGetIndexInfo
JetGetIndexInfo@28
JetGetLock
JetGetLock@12
JetGetLogInfo
JetGetLogInfo@12
JetGetObjectInfo
JetGetObjectInfo@32
JetGetObjidFromName
JetGetObjidFromName@20
JetGetRecordPosition
JetGetRecordPosition@16
JetGetSystemParameter
JetGetSystemParameter@24
JetGetTableColumnInfo
JetGetTableColumnInfo@24
JetGetTableIndexInfo
JetGetTableIndexInfo@24
JetGetTableInfo
JetGetTableInfo@20
JetGetVersion
JetGetVersion@8
JetGotoBookmark
JetGotoBookmark@16
JetGotoPosition
JetGotoPosition@12
JetGrowDatabase
JetGrowDatabase@16
JetIdle
JetIdle@8
JetIndexRecordCount
JetIndexRecordCount@16
JetInit
JetInit@4
JetIntersectIndexes
JetIntersectIndexes@20
JetMakeKey
JetMakeKey@20
JetMove
JetMove@16
JetOpenDatabase
JetOpenDatabase@20
JetOpenFile
JetOpenFile@16
JetOpenTable
JetOpenTable@28
JetOpenTempTable
JetOpenTempTable2
JetOpenTempTable2@28
JetOpenTempTable3
JetOpenTempTable3@28
JetOpenTempTable@24
JetPrepareUpdate
JetPrepareUpdate@12
JetReadFile
JetReadFile@16
JetRenameTable
JetRenameTable@16
JetResetCounter
JetResetCounter@8
JetResetSessionContext
JetResetSessionContext@4
JetRestore
JetRestore2
JetRestore2@12
JetRestore@8
JetRetrieveColumn
JetRetrieveColumn@32
JetRetrieveColumns
JetRetrieveColumns@16
JetRetrieveKey
JetRetrieveKey@24
JetRetrieveTaggedColumnList
JetRetrieveTaggedColumnList@28
JetRollback
JetRollback@8
JetSeek
JetSeek@12
JetSetColumn
JetSetColumn@28
JetSetColumnDefaultValue
JetSetColumnDefaultValue@28
JetSetColumns
JetSetColumns@16
JetSetCurrentIndex
JetSetCurrentIndex2
JetSetCurrentIndex2@16
JetSetCurrentIndex3
JetSetCurrentIndex3@20
JetSetCurrentIndex4
JetSetCurrentIndex4@24
JetSetCurrentIndex@12
JetSetDatabaseSize
JetSetDatabaseSize@16
JetSetIndexRange
JetSetIndexRange@12
JetSetSessionContext
JetSetSessionContext@8
JetSetSystemParameter
JetSetSystemParameter@20
JetStopBackup
JetStopBackup@0
JetStopService
JetStopService@0
JetTerm
JetTerm2
JetTerm2@8
JetTerm@4
JetTruncateLog
JetTruncateLog@0
JetUpdate
JetUpdate@20
ese
ese@20

Sections

.text
Size: 698KB - Virtual size: 697KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 326KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e82bdee8ff6aafc7aa065dc48545f28

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

Exports

Exports

Sections

.text Size: 698KB - Virtual size: 697KB

.data Size: 22KB - Virtual size: 53KB

.rsrc Size: 326KB - Virtual size: 328KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 698KB - Virtual size: 697KB

.data
Size: 22KB - Virtual size: 53KB

.rsrc
Size: 326KB - Virtual size: 328KB

.reloc
Size: 40KB - Virtual size: 40KB