99881659f4a08c410a142746d8baaea8146a87ec37c8a857c361bd01ae9bb8f6

Sharing

Copy URL Twitter E-mail

General

Target

99881659f4a08c410a142746d8baaea8146a87ec37c8a857c361bd01ae9bb8f6
Size

10.0MB
MD5

66f5b87296f2b4ae99035345d973e038
SHA1

8ee3559c62b30769fbf3d5e339e4366d30834abd
SHA256

99881659f4a08c410a142746d8baaea8146a87ec37c8a857c361bd01ae9bb8f6
SHA512

014391b1fdca7ddbed904cce8a03b39290b7931c1740daf14427b1797afedb41996f2cc7677779a1b9c7ac223a7af8878100f94955fb7f9bef930d129c66fddd
SSDEEP

384:QTBs5A3n6VkiMir8Mpat+kbFmnLGUI6rGirBXJK3O368vgRMWUWg:Q9scgktir3atUnyUI0K3O36BRo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99881659f4a08c410a142746d8baaea8146a87ec37c8a857c361bd01ae9bb8f6

Files

99881659f4a08c410a142746d8baaea8146a87ec37c8a857c361bd01ae9bb8f6
.dll windows:6 windows x64 arch:x64

6e47a7d45ef7bc999b128e052f7dc39d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

srand
rand
strcpy_s
strcat_s
_beginthreadex
wcscpy_s
wcscat_s
free
strchr
vsprintf_s
malloc
sprintf_s
ftell
fclose
fseek
fopen_s
fread
memcpy
memset

kernel32

SetLastError
IsBadReadPtr
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualProtect
lstrcpyA
GetSystemDirectoryA
MultiByteToWideChar
lstrcatA
GetTickCount
CreateEventA
FlushInstructionCache
GetCurrentProcessId
CreateFileMappingA
GetProcAddress
CreateThread
CloseHandle
GetModuleFileNameA
GetCurrentProcess
CreateMutexA
GetCurrentThreadId
GetModuleHandleA
Sleep
SetEvent

user32

ActivateKeyboardLayout
SetPropA
DispatchMessageA
LoadCursorA
SetWindowLongPtrW
MsgWaitForMultipleObjects
GetWindowLongPtrW
SetTimer
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
PeekMessageA
GetWindowLongPtrA
KillTimer
IsWindowUnicode
FindWindowA
RegisterClassExA
SetWindowLongPtrA

Exports

Exports

CandWndProc
CompWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e47a7d45ef7bc999b128e052f7dc39d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 684B

.rsrc Size: 1024B - Virtual size: 528B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 684B

.rsrc
Size: 1024B - Virtual size: 528B