65d2b69aca90e79834a49a898f96b0e33c37cbcec70f786381d68fa3f231416dN

General

Target

65d2b69aca90e79834a49a898f96b0e33c37cbcec70f786381d68fa3f231416dN
Size

107KB
MD5

1f72ef9a505ae7cea1eebd1d07b9a190
SHA1

68cfb45e698a35c935bce19b4c2cc840f892e33b
SHA256

65d2b69aca90e79834a49a898f96b0e33c37cbcec70f786381d68fa3f231416d
SHA512

de46f85897ee1498653ad572231eab718d02d1ffcce83af99dfb847adf2fd01a1fe8e1f40f44f657848e014aa29c4b8bda7c83bb80b8e9ca85f42fef56e9d69b
SSDEEP

1536:/i1+hCyMR09Wt/fra6+Th70Z4eIRK8ntmSi5k8XKOL6i0QJGX+7YUev98GnQi7XW:/i1+hCyn9WRI0Z6D1OrhGLqjchyLAU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65d2b69aca90e79834a49a898f96b0e33c37cbcec70f786381d68fa3f231416dN

Files

65d2b69aca90e79834a49a898f96b0e33c37cbcec70f786381d68fa3f231416dN
.dll windows:4 windows x86 arch:x86

2af5a8c9f06fc2ec437a6643c4c1e64c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

remote-yilder.pdb

Imports

kernel32

InterlockedCompareExchange
GetTickCount
GetFileAttributesW
CreateMutexW
LocalReAlloc
_lopen
CreateConsoleScreenBuffer
GlobalUnfix
FindNextVolumeMountPointW
SetThreadPriority
LocalShrink
GetLogicalDriveStringsA
ReadConsoleA
FoldStringA
WaitForMultipleObjectsEx
TlsGetValue
GetHandleInformation
GetPrivateProfileIntA
GetBinaryTypeA
GetTapeParameters
ResumeThread
SwitchToFiber
GetFileTime
GetCurrentProcess
SetConsoleWindowInfo
ProcessIdToSessionId
EnumSystemLanguageGroupsW
_lwrite
UnmapViewOfFile
TlsSetValue
RemoveDirectoryA
VirtualAlloc
QueueUserWorkItem
_lread
WriteProfileSectionW
IsProcessorFeaturePresent
EnumSystemCodePagesW
QueryDosDeviceA

ntdll

toupper

Exports

Exports

JinBeginAction
JinEndAction

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

adata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 320B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2af5a8c9f06fc2ec437a6643c4c1e64c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 36KB - Virtual size: 36KB

adata Size: 38KB - Virtual size: 38KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 320B - Virtual size: 68KB

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 36KB - Virtual size: 36KB

adata
Size: 38KB - Virtual size: 38KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 320B - Virtual size: 68KB