65698d0f78a8b142e28e077c1bac2bf24a950df6c46277c4a76b12066d4977f8

Sharing

Copy URL

Twitter E-mail

General

Target

65698d0f78a8b142e28e077c1bac2bf24a950df6c46277c4a76b12066d4977f8
Size

50KB
MD5

af7210680d438a82c1f2539ee82e0ae4
SHA1

7ecc373ae91d7dee40a6cda7fee5e9348ae71e17
SHA256

65698d0f78a8b142e28e077c1bac2bf24a950df6c46277c4a76b12066d4977f8
SHA512

7ee2479bc189a3258b4c0eb2d1421ce6b48e1d2a55371b8bf93f240009733af6d8a9e63093469923ae5b9a073dd83cec30d9a60c70c7432de1ee901b95757dfd
SSDEEP

768:6dwNNlcdyo+4lMreJfbg52cyJkWtyC3VQGPL4vzZq2o9W7GsxBbPr:6OwY4m6fbZ3pty0SGCq2iW7z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
65698d0f78a8b142e28e077c1bac2bf24a950df6c46277c4a76b12066d4977f8

Files

65698d0f78a8b142e28e077c1bac2bf24a950df6c46277c4a76b12066d4977f8
.exe windows:6 windows x86 arch:x86

7798a1128b77e02ae0b433b2fbeb2f55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\github\libusbk\libusbk\bin\exe\i386\dpscat.pdb

Imports

advapi32

CryptDestroyKey
CryptGenKey
CryptAcquireContextW
CryptReleaseContext

kernel32

OutputDebugStringA
WriteFile
GetStdHandle
WriteConsoleW
LocalFree
FreeConsole
SetConsoleCursorPosition
ReadConsoleOutputCharacterW
GetConsoleScreenBufferInfo
AttachConsole
GetCommandLineW
FindNextFileW
FindFirstFileW
GetLastError
GetCurrentDirectoryW
SetLastError
GetNativeSystemInfo
LockResource
LoadResource
SizeofResource
FindResourceA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
GetVersionExW
GetProcAddress
LoadLibraryA
GetModuleHandleA
FormatMessageW
VerifyVersionInfoW
VerSetConditionMask
GetFileAttributesW
CloseHandle
CreateFileW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange

user32

wsprintfW

msvcrt

exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_XcptFilter
wcstoul
_cexit
__wgetmainargs
_errno
malloc
free
mbstowcs
wcstombs
_wcsicmp
_wfopen
_snwprintf
fwrite
fflush
fclose
memset
_wcsnset
_vsnwprintf
_wcsnicmp
_wcslwr
_exit

setupapi

SetupCloseInfFile
SetupFindNextLine
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupFindFirstLineW
SetupOpenInfFileW
SetupDiGetActualSectionToInstallExW

shlwapi

PathRelativePathToW
PathMatchSpecW
PathRemoveFileSpecW
PathAppendW
PathStripPathW
PathFileExistsW

shell32

CommandLineToArgvW

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

�;��u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7798a1128b77e02ae0b433b2fbeb2f55

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

setupapi

shlwapi

shell32

Sections

.text Size: 27KB - Virtual size: 26KB

.data Size: 1024B - Virtual size: 30KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

�;��u� Size: 16KB - Virtual size: 20KB

.text
Size: 27KB - Virtual size: 26KB

.data
Size: 1024B - Virtual size: 30KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

�;��u�
Size: 16KB - Virtual size: 20KB