file | Triage

Resubmissions

22-02-2022 16:11

220222-tm7absbhgj 10

17-02-2022 11:08

220217-m81w4sbah9 10

Sharing

Copy URL

Twitter E-mail

General

Target

file
Size

716KB
MD5

d11b33842a24e8509f51f4f1277c3b6a
SHA1

d555b0354a8fc2dd6f19f47a9fed0571eec13817
SHA256

608e75d13e439f0578cd157b7be52cc8718d853ff80746abb7066977efc86be6
SHA512

1876391b5bf20f3915d1de46e88a955cc9cda46ff46c2a91b8272564fc82fec5e96e5c3c48fa4ecfbda0782328c15570594a8db62055d4dbe93b80cd7051bee0
SSDEEP

12288:0QHrRbsTP9qoTVIj8xjmHFlmxQIbOG9PdqT/gt/ssPCnJW/eJunO1LD4YgI:0+9bEpVs8EHHjgOSPEsPR/ounOv/

Score

N/A

Malware Config

Signatures

Files

file
.zip
core.bat
hockey-x32.tmp
.dll windows x64

effc5e4cb055f4e89eae0e3e80880cc4

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetLargePageMinimum
IsDebuggerPresent
GetSystemDefaultLangID
FlushProcessWriteBuffers
GetCurrentThread
SwitchToThread
GetCurrentThreadId
GetErrorMode
GetCurrentProcessorNumber
GetCommandLineW
GetOEMCP
GetLastError
GetTickCount
GetThreadUILanguage
GetEnvironmentStringsW
GetUserDefaultUILanguage
GetACP
GetThreadLocale
GetThreadErrorMode
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
MultiByteToWideChar
LoadResource
SizeofResource
FindResourceW
GetModuleHandleW
GetProcAddress
UnregisterApplicationRecoveryCallback
GetModuleFileNameW
lstrcmpiW
FreeLibrary
WriteConsoleW
CreateFileW
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetCommandLineA
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetStdHandle
HeapFree
HeapReAlloc
GetProcessHeap
TlsAlloc
CloseHandle
ReadFile
FindClose
GetTickCount64
LoadLibraryExW
LoadLibraryA
HeapAlloc
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
OutputDebugStringW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
SetLastError
EncodePointer
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead

user32

GetProcessWindowStation
GetCursor
IsProcessDPIAware
GetOpenClipboardWindow
InSendMessage
CloseClipboard
GetDesktopWindow
CreateMenu
GetClipboardViewer
GetForegroundWindow
GetActiveWindow
EmptyClipboard
AnyPopup
CountClipboardFormats
GetMessageTime
GetCapture
SetCursor
LoadCursorW
CharNextW
GetMenuCheckMarkDimensions
IsWow64Message
GetClipboardSequenceNumber
GetKBCodePage

gdi32

GdiFlush

advapi32

RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW

shell32

InitNetworkAddressControl

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleUninitialize
CoFreeUnusedLibraries

oleaut32

VarUI4FromStr

wininet

InternetQueryDataAvailable

Exports

Exports

DllMain
atcuskcyn
cimnelchghw
cqhtimspcrktgj
cyborqjlkntpbz
cyysbzuevlvrqhtp
dtibjvbmqhncsyq
ehcqzhqvyzvppwtb
eieubxsjxz
flsuzirpginvk
fmbiqgswtvzpn
ggiznyicfhag
gxzaqegjs
hmmaikvzvvokrtpve
hwjbmfg
ibdumzwdgqjfjwzr
icqvjbouonakra
jkvtguvvkdj
juawnkffzmtmmffn
kkccsdlgaemuh
kvarbzgr
kvohgapddg
lgrvohaafmzl
mjaphthwea
mnlfejxglsta
mpwlioqtotmqedcm
mwgynatsbmsljrffk
myguyvg
oezbcvw
ogwhpthvjtflqf
oibcrrfjgadyp
oilgoan
otyqdzhgsewnjh
pboikdoq
pglbbspaepdfnsmtb
qfbumtu
qhpweufdkruv
qjvoxjhrxuwrcanza
qzgnezmjkcgo
rnujcoujrzo
smodtghyrnfkiohx
sqkklrvpxwqd
tdudysek
tjjdlapcnpt
tqzobjbetydxmax
uildkwefaggicm
uxhpsnulei
vcxizanyu
vvfrnesxwavsexq
wbhkaikluwkv
xgdusmvae
xhlcyrex
yjrzvsyoqpwori
yqatwomdiagyppxk
ywgzrfylrse
zdizhqmemugf
zuywoxpuhgadrzj

Sections

.text
Size: 255KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gehcont
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
license.dat

Resubmissions

Sharing

General

Malware Config

Signatures

Files

effc5e4cb055f4e89eae0e3e80880cc4

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

Exports

Exports

Sections

.text Size: 255KB - Virtual size: 255KB

.rdata Size: 225KB - Virtual size: 224KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 10KB - Virtual size: 9KB

.gfids Size: 1024B - Virtual size: 792B

.tls Size: 512B - Virtual size: 9B

.gehcont Size: 512B - Virtual size: 32B

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 255KB - Virtual size: 255KB

.rdata
Size: 225KB - Virtual size: 224KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 10KB - Virtual size: 9KB

.gfids
Size: 1024B - Virtual size: 792B

.tls
Size: 512B - Virtual size: 9B

.gehcont
Size: 512B - Virtual size: 32B

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 3KB - Virtual size: 3KB