35e6b4ddb6defc354e5e342eee454f6b2fd000d986882aecb2ac46bd0cfa224e

Sharing

Copy URL Twitter E-mail

General

Target

35e6b4ddb6defc354e5e342eee454f6b2fd000d986882aecb2ac46bd0cfa224e
Size

82KB
MD5

1318b83783e79471b6623e85aa74d060
SHA1

9a400d5f0f187e3cf877de656def60a031a566dd
SHA256

35e6b4ddb6defc354e5e342eee454f6b2fd000d986882aecb2ac46bd0cfa224e
SHA512

bdd0bdcc95c6e8749b3d71a5569838b8307754fb2c791e0a02221835be381bfcfb121a05ab551378fd25e1382161babd0ad504216db77c52eb9031139b81ccc9
SSDEEP

1536:Jh5MTnDI9ZpiJWSnnoE9lmFt0F7FritoCr+PGGMByl5l+5nP5:JhaDI9Xm45FtS7pitoCr+P7MByl5l+J5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35e6b4ddb6defc354e5e342eee454f6b2fd000d986882aecb2ac46bd0cfa224e

Files

35e6b4ddb6defc354e5e342eee454f6b2fd000d986882aecb2ac46bd0cfa224e
.dll windows:4 windows x86 arch:x86

6d4a12e7e89e5b958d456a3b1839a0d1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CreateSemaphoreA
FindAtomA
GetAtomNameA
GetLastError
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject

msvcrt

__dllonexit
_assert
_errno
abort
fflush
fopen
fprintf
free
malloc
memset
strcat
strcmp

madchook

HookCode

lua5.1

lua_settop
luaL_register
lua_getfield
lua_tolstring
lua_tonumber
lua_error
lua_pushstring
lua_gettop
lua_setfield
lua_pushnumber
luaL_loadstring
lua_pcall
luaL_loadfile
lua_close
lua_pushnil
luaopen_string
luaopen_math
luaopen_table
luaopen_base
lua_cpcall
lua_atpanic
luaL_newstate
lua_pushboolean

Exports

Exports

DllMain@12

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d4a12e7e89e5b958d456a3b1839a0d1

Headers

File Characteristics

Imports

kernel32

msvcrt

madchook

lua5.1

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.data Size: 6KB - Virtual size: 5KB

.rdata Size: 21KB - Virtual size: 20KB

.bss Size: - Virtual size: 16KB

.edata Size: 512B - Virtual size: 72B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 47KB - Virtual size: 46KB

.data
Size: 6KB - Virtual size: 5KB

.rdata
Size: 21KB - Virtual size: 20KB

.bss
Size: - Virtual size: 16KB

.edata
Size: 512B - Virtual size: 72B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 4KB - Virtual size: 3KB