35e81f36c3de246213499f9d9582b5bfc1edd2b4f1ff3851806c08be0d7d881cN

Sharing

Copy URL Twitter E-mail

General

Target

35e81f36c3de246213499f9d9582b5bfc1edd2b4f1ff3851806c08be0d7d881cN
Size

59KB
MD5

febb7715f9a803bf2dfda96c42dccba0
SHA1

4ce3838905e4070e5815aab614d4454903c4ae08
SHA256

35e81f36c3de246213499f9d9582b5bfc1edd2b4f1ff3851806c08be0d7d881c
SHA512

e84cae2760993f7f2e4477ea25dffca00180dec1e434bcbfceabeb9e57c592fa8ca0a19c1fc83f608f7030ae5e6067a5f92826c5d2567054a185ab84a71c39bd
SSDEEP

1536:VMGFPkmPVrBmm6P0oWoj69DIaaaSJCiFqevfxhqAk+8fUX8:VMW8mNrBmmM69DIRaS5FqejR8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35e81f36c3de246213499f9d9582b5bfc1edd2b4f1ff3851806c08be0d7d881cN

Files

35e81f36c3de246213499f9d9582b5bfc1edd2b4f1ff3851806c08be0d7d881cN
.dll windows:5 windows x86 arch:x86

727af8c799b4ede637e4b39add8ac554

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetLocaleInfoA
CloseHandle
HeapUnlock
VerLanguageNameA
OpenProcess
CreateEventA
Sleep
GlobalUnlock
VirtualAlloc
GlobalReAlloc
GlobalFree
GetModuleFileNameA
WideCharToMultiByte
SetThreadPriority
GlobalHandle
LoadLibraryA
FreeLibrary
SetEndOfFile
InterlockedDecrement
LoadLibraryExA

ntdll

ZwReleaseSemaphore
ZwCreateSemaphore

clb

ClbWndProc

Exports

Exports

CreateProcessNotify
GetOwnerModuleFromUdp6Entry
SetIpStatistics
NTTimeToNTPTime
Icmp6CreateFile
NTPTimeToNTFileTime
NotifyAddrChange
InternalCreateIpForwardEntry
GetAdapterIndex
GetBestInterfaceEx
GetIpErrorString
InternalGetIfTable
DeleteProxyArpEntry
CreateIpNetEntry
InternalSetIpNetEntry
DeleteIPAddress
IcmpCloseHandle
InternalCreateIpNetEntry
UnenableRouter
GetOwnerModuleFromTcpEntry
GetBestInterface
NhGetInterfaceNameFromGuid
GetTcpStatistics
GetUdpStatisticsEx
CreateIpForwardEntry
DisableMediaSense
GetIcmpStatisticsEx
IpReleaseAddress
InternalGetUdpTable
GetAdapterOrderMap
SetIpForwardEntry
GetIpAddrTable
InternalGetIpNetTable
SetIpTTL
AllocateAndGetIpAddrTableFromStack
SendARP
GetExtendedUdpTable
GetBestRoute
NhGetInterfaceNameFromDeviceGuid
InternalSetIfEntry
NhpAllocateAndGetInterfaceInfoFromStack
DeleteIpForwardEntry
InternalDeleteIpForwardEntry
CreateProxyArpEntry
InternalDeleteIpNetEntry
Icmp6ParseReplies
GetUniDirectionalAdapterInfo
GetIcmpStatistics
GetRTTAndHopCount
DeleteIpNetEntry
GetExtendedTcpTable
InternalSetTcpEntry
GetOwnerModuleFromUdpEntry
do_echo_rep

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

727af8c799b4ede637e4b39add8ac554

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

clb

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 43KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB