b677d24cb4dae00698769d0e5d5be4d217e6c819d9db93e3143ae1cc297cfe97N

General

Target

b677d24cb4dae00698769d0e5d5be4d217e6c819d9db93e3143ae1cc297cfe97N
Size

27KB
MD5

9f891aa217b62d9069556b4e8ff6ec80
SHA1

e4b834a618274ae7e33036817f3f3ebc4c960dac
SHA256

b677d24cb4dae00698769d0e5d5be4d217e6c819d9db93e3143ae1cc297cfe97
SHA512

d9710307f978d245587d8b494fa8c705d09e4a0f6395cc456b8449b663fe4d96d24a05e95c83b81ff36202c1bb3d810e79fd2e4a455b148ce295a0a1d64e47ec
SSDEEP

384:ARPtqrtIIG4vaT+xcqLxRpRx8A/I8/0UV4xjAp8Rl38bBB2rjBpI4BpV:qP+aT+lLxzRqAqxjAp8RlMkf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b677d24cb4dae00698769d0e5d5be4d217e6c819d9db93e3143ae1cc297cfe97N

Files

b677d24cb4dae00698769d0e5d5be4d217e6c819d9db93e3143ae1cc297cfe97N
.dll windows:5 windows x86 arch:x86

69557c3a66491c6d4012808f69501618

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_except_handler3
atol
strncpy
strncmp
strstr
_strnicmp
sprintf
remove
fread
fopen
fwrite
fclose
free
malloc

kernel32

DisableThreadLibraryCalls
CreateMutexA
ExitProcess
GetSystemTime
GetComputerNameA
GetACP
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WinExec
CopyFileA
TerminateThread
WaitForSingleObject
SetEvent
CloseHandle
GetTickCount
GetModuleHandleA
CreateEventA
GetLastError
IsBadReadPtr
Sleep
ResetEvent
CreateThread
GetProcAddress
LoadLibraryA
FreeLibrary
ReleaseMutex
TerminateProcess
GetFileAttributesA
CreateProcessA
GetTempFileNameA
GetTempPathA
GetSystemDirectoryA
DeleteFileA
OutputDebugStringA
lstrcmpiA
GetVersionExA
GetDiskFreeSpaceA
FindClose
FindNextFileA
RemoveDirectoryA
FindFirstFileA
SetFileTime
CreateFileA
GetDriveTypeA
GetLogicalDriveStringsA
FileTimeToSystemTime
LocalFileTimeToFileTime
CreateDirectoryA
MoveFileA
SetFileAttributesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

DllRegisterWinAppCleanup
DllRegisterWinAppStartup

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69557c3a66491c6d4012808f69501618

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.data Size: - Virtual size: 752B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 24KB

.data
Size: - Virtual size: 752B

.reloc
Size: 1KB - Virtual size: 1KB