21fc0f50d545c0a373380934dc61c423c8a31d8c3e6eae4f8a35149ad9962d88

Sharing

Copy URL Twitter E-mail

General

Target

21fc0f50d545c0a373380934dc61c423c8a31d8c3e6eae4f8a35149ad9962d88
Size

4.0MB
MD5

28e01e0e53585ecf68b47f1b2f5bfd33
SHA1

be11eb2d3983319f078c5facbfe53756ddf86a44
SHA256

21fc0f50d545c0a373380934dc61c423c8a31d8c3e6eae4f8a35149ad9962d88
SHA512

53cc11327ec45cfc6b2649733898d9d64c45bdf6f07ba36be1220047cfaf34be1fe865b69cf7dffe8c581d75da93fbcfb19b9d05281d465580a6ab503e8f6b89
SSDEEP

49152:NbjKE/zaPoION6Qrh0b28/Q9eMkAwDrAV7tLpLysPlv:NbuE/mPoQH/5HvAVNVv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21fc0f50d545c0a373380934dc61c423c8a31d8c3e6eae4f8a35149ad9962d88

Files

21fc0f50d545c0a373380934dc61c423c8a31d8c3e6eae4f8a35149ad9962d88
.dll windows:6 windows x64 arch:x64

550fe420e15816dd524a53325fea6629

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

WriteConsoleW
HeapFree
HeapAlloc
GetProcessHeap
Sleep
LoadLibraryW
GetProcAddress
GetSystemTime
ReadFile
FindFirstFileW
VirtualProtect
FindNextFileW
GetCurrentProcess
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
FindClose
SetFilePointerEx
LoadLibraryA
CloseHandle
GetModuleHandleW
GetModuleHandleA
CreateMutexA
GetLastError
GetModuleFileNameW
VirtualProtectEx
LocalFree
ExitProcess
ReadProcessMemory
GetCurrentProcessId
FreeLibrary
LoadLibraryExW
CreateFileW
GetFileType
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
TerminateProcess
GetModuleHandleExW
LCMapStringW

Exports

Exports

ServiceMain

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

550fe420e15816dd524a53325fea6629

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 252B

.reloc Size: 3.9MB - Virtual size: 3.9MB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 252B

.reloc
Size: 3.9MB - Virtual size: 3.9MB