ab530b1c8e0709f05feb05dfb3a18048fa0e5c034179ca50c49b65212cf602de

Sharing

Copy URL Twitter E-mail

General

Target

ab530b1c8e0709f05feb05dfb3a18048fa0e5c034179ca50c49b65212cf602de
Size

81KB
MD5

4c916956815ad954d78fb2ae64405292
SHA1

3d557b26d15c5bdb9a0c223c10b4f50a8d71bc90
SHA256

ab530b1c8e0709f05feb05dfb3a18048fa0e5c034179ca50c49b65212cf602de
SHA512

2bd53e85b230c681be2894a43b5e37b2cf0db9a61a027ff93487bd0e74eea536278cf3de0b6b9ab4bb60bdb7231522aa72f5bb3b84eff14cab1df75705172237
SSDEEP

1536:yYErjpCZk0Q2tDf36onloX/F15l7vMRP+gLBqYKp:ynrjpCO0VRxlot15xvM8gLBYp

Score

N/A

Malware Config

Signatures

Files

ab530b1c8e0709f05feb05dfb3a18048fa0e5c034179ca50c49b65212cf602de
.dll windows x86

db6ae8c2354513f1e410c39d3b1a73aa

Code Sign

3d:1f:50:c9:d1:f3:36:8b:41:28:a5:6f:fa:3e:f4:e4
Certificate

Issuer

CN=dfgwetwerg

Not Before

17/01/2012, 06:33

Not After

31/12/2039, 23:59

Subject

CN=dfgwetwerg

Extended Key Usages

ExtKeyUsageCodeSigning

f3:8c:a1:3c:50:e4:72:9b:f7:cb:b3:48:98:0f:95:b6:10:9c:ad:36
Signer

Actual PE Digest

f3:8c:a1:3c:50:e4:72:9b:f7:cb:b3:48:98:0f:95:b6:10:9c:ad:36

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=dfgwetwerg

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

WriteConsoleOutputCharacterW
_lcreat
lstrcatA
WaitForDebugEvent
lstrcmpi
lstrlen
VirtualQueryEx
VirtualFreeEx
VirtualAllocEx
UnlockFileEx
TlsFree
TerminateThread
SetTimerQueueTimer
SetThreadLocale
SetSystemTimeAdjustment
SetSystemPowerState
SetProcessPriorityBoost
SetEnvironmentVariableW
SetComputerNameExW
SetCommBreak
SetCalendarInfoW
SearchPathA
ScrollConsoleScreenBufferA
RtlMoveMemory
ReadConsoleOutputCharacterW
ReadConsoleOutputAttribute
Process32First
PeekNamedPipe
OpenMutexW
OpenMutexA
OpenJobObjectW
OpenFileMappingW
MoveFileW
MoveFileExA
LockFile
LocalUnlock
LocalReAlloc
LocalAlloc
LoadResource
LoadLibraryW
LoadLibraryExW
IsProcessorFeaturePresent
IsDebuggerPresent
InterlockedDecrement
GetWriteWatch
GetWindowsDirectoryA
GetTimeZoneInformation
GetThreadLocale
GetTempPathW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetQueuedCompletionStatus
GetProfileSectionW
GetProfileSectionA
GetProfileIntA
GetProcessIoCounters
GetProcessHeap
GetProcessAffinityMask
GetNumberOfConsoleMouseButtons
GetModuleFileNameA
GetMailslotInfo
GetLogicalDriveStringsW
GetFullPathNameA
GetFileType
GetDriveTypeA
GetDateFormatW
GetCurrentConsoleFont
GetConsoleAliasExesA
GetCommModemStatus
GetACP
FreeLibraryAndExitThread
FreeConsole
VirtualAlloc
FoldStringA
FindResourceA
FindFirstFileA
FillConsoleOutputCharacterW
EnumSystemLocalesA
EnumSystemCodePagesA
EnumDateFormatsA
EndUpdateResourceW
DuplicateHandle
DeviceIoControl
DeleteTimerQueue
CreateWaitableTimerA
CreateTapePartition
CreateNamedPipeA
CreateFileMappingW
CreateEventW
ConvertDefaultLocale
BuildCommDCBAndTimeoutsW
BuildCommDCBAndTimeoutsA
Beep
AreFileApisANSI
GetWindowsDirectoryW
lstrlenW
lstrcpyW
CreateFileW
GetModuleHandleA
GetProcAddress
ExitProcess
lstrcmpA

user32

DrawFrameControl
DrawFocusRect
DlgDirSelectComboBoxExW
DdeInitializeW
DdeGetLastError
DdeAccessData
CreateWindowExW
CreateDialogParamW
CreateDialogParamA
CreateDesktopW
CountClipboardFormats
ChildWindowFromPointEx
CharToOemBuffW
CharPrevExA
CharNextW
ChangeDisplaySettingsExW
CallWindowProcA
BlockInput
AppendMenuW
LoadIconA
DrawMenuBar
DrawTextW
EndTask
EqualRect
FindWindowW
GetAltTabInfoA
GetAltTabInfoW
GetCaretPos
GetClassInfoA
GetClipCursor
GetCursorInfo
GetDialogBaseUnits
GetGUIThreadInfo
GetInputState
GetKeyboardLayoutList
GetMenuContextHelpId
GetMenuItemCount
GetMenuItemID
GetMenuStringW
GetMessageTime
GetNextDlgGroupItem
GetParent
GetPropA
GetShellWindow
GetSubMenu
GetWindow
GetWindowRect
HiliteMenuItem
IMPSetIMEA
InsertMenuA
IsCharAlphaW
IsDialogMessageA
IsDialogMessageW
IsWindowEnabled
LoadBitmapW
LoadMenuIndirectW
LoadStringA
LoadStringW
LockWindowUpdate
MapVirtualKeyA
MapVirtualKeyExW
MapWindowPoints
MonitorFromRect
OpenWindowStationA
RegisterClassExW
RegisterHotKey
SendIMEMessageExW
SendInput
SendMessageA
SendNotifyMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetDeskWallpaper
SetLastErrorEx
SetMenu
SetMenuItemBitmaps
wvsprintfA
WINNLSEnableIME
UserHandleGrantAccess
UnregisterClassW
UnregisterClassA
ToAscii
TileWindows
SwapMouseButton
ShowScrollBar
SetWindowTextW
SetWindowPlacement
SetWindowLongW
SetUserObjectSecurity
SetScrollInfo
SetMenuItemInfoW

gdi32

ChoosePixelFormat
CreateCompatibleDC
CreateDIBSection
CreatePolygonRgn
CreateScalableFontResourceA
EnableEUDC
EndFormPage
EndPage
EngBitBlt
EngComputeGlyphSet
EngCopyBits
EngGetPrinterDataFileName
EngLockSurface
EngReleaseSemaphore
EngTextOut
EnumICMProfilesW
EnumMetaFile
EnumObjects
EudcUnloadLinkW
ExtCreatePen
ExtSelectClipRgn
ExtTextOutW
FONTOBJ_pvTrueTypeFontFile
GdiAddGlsRecord
GdiArtificialDecrementDriver
GdiConvertBitmapV5
GdiConvertEnhMetaFile
GdiEntry11
GdiEntry9
GdiFullscreenControl
GdiGetLocalDC
GdiInitializeLanguagePack
GdiPlayDCScript
GdiPlayJournal
GdiPrinterThunk
GdiReleaseDC
GdiSetLastError
GetArcDirection
GetCharWidthInfo
GetCurrentPositionEx
GetDIBits
GetFontResourceInfoW
GetGraphicsMode
GetKerningPairsA
GetMetaFileBitsEx
AnyLinkedFonts
GetObjectType
GetPixel
GetRandomRgn
GetRasterizerCaps
GetRelAbs
GetStringBitmapA
GetSystemPaletteUse
GetTextCharset
GetTextFaceA
GetTextMetricsA
GetViewportOrgEx
GetWorldTransform
HT_Get8BPPFormatPalette
HT_Get8BPPMaskPalette
IntersectClipRect
InvertRgn
OffsetViewportOrgEx
OffsetWindowOrgEx
PATHOBJ_bEnum
PathToRegion
PlayEnhMetaFile
PolyBezier
PolyDraw
ResetDCA
STROBJ_bEnum
SelectClipPath
SetAbortProc
SetBitmapDimensionEx
SetBkColor
SetDCPenColor
SetDeviceGammaRamp
SetEnhMetaFileBits
SetMiterLimit
SetPixelV
SetPolyFillMode
SetStretchBltMode
SetTextColor
StretchDIBits
TextOutW
WidenPath
XFORMOBJ_iGetXform
XLATEOBJ_hGetColorTransform
XLATEOBJ_piVector
cGetTTFFromFOT
GetObjectA
GdiDeleteLocalDC
BeginPath

advapi32

RegOpenKeyExW

shell32

SHEmptyRecycleBinW
Shell_NotifyIconA
Shell_NotifyIcon
ShellHookProc
ShellExecuteExW
ShellExecuteEx
ShellAboutA
SHQueryRecycleBinA
SHPathPrepareForWriteA
SHLoadNonloadedIconOverlayIdentifiers
SHLoadInProc
SHIsFileAvailableOffline
SHInvokePrinterCommandA
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHGetPathFromIDListW
DoEnvironmentSubstA
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
DuplicateIcon
ExtractAssociatedIconA
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractIconA
ExtractIconEx
ExtractIconW
FindExecutableA
SHAppBarMessage
SHBindToParent
SHBrowseForFolderA
SHBrowseForFolderW
SHCreateDirectoryExA
SHCreateDirectoryExW
SHCreateProcessAsUserW
SHEmptyRecycleBinA
SHGetPathFromIDListA
SHFileOperation
SHFileOperationA
SHFileOperationW
SHFormatDrive
SHFreeNameMappings
SHGetDataFromIDListA
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceExW
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetIconOverlayIndexW
SHGetInstanceExplorer
SHGetMalloc
Shell_NotifyIconW

ole32

CoSetProxyBlanket
CoTaskMemRealloc
CoUnmarshalInterface
CreateAntiMoniker
CreateBindCtx
CreateDataCache
CreateFileMoniker
CreateItemMoniker
CreateObjrefMoniker
CreateStdProgressIndicator
CreateStreamOnHGlobal
DoDragDrop
GetConvertStg
GetHGlobalFromStream
GetRunningObjectTable
HACCEL_UserMarshal
HACCEL_UserSize
HBITMAP_UserMarshal
HBITMAP_UserUnmarshal
HBRUSH_UserMarshal
HBRUSH_UserSize
HDC_UserSize
HENHMETAFILE_UserFree
HENHMETAFILE_UserMarshal
HENHMETAFILE_UserSize
HICON_UserFree
HICON_UserMarshal
HMETAFILE_UserMarshal
HMETAFILE_UserUnmarshal
HWND_UserSize
IsAccelerator
OleBuildVersion
OleCreateDefaultHandler
OleCreateEx
OleCreateFromData
OleCreateFromDataEx
OleCreateLinkFromData
OleDoAutoConvert
OleDuplicateData
OleFlushClipboard
OleGetAutoConvert
OleGetIconOfClass
OleInitialize
OleLoad
OleLoadFromStream
OleLockRunning
OleMetafilePictFromIconAndLabel
OleNoteObjectVisible
OleQueryLinkFromData
OleRegGetMiscStatus
OleRun
OleTranslateAccelerator
OpenOrCreateStream
ProgIDFromCLSID
PropVariantCopy
ReadClassStg
ReadStringStream
SNB_UserFree
SetDocumentBitStg
StgCreatePropSetStg
StgOpenStorage
StgOpenStorageEx
StgPropertyLengthAsVariant
StringFromGUID2
UpdateDCOMSettings
UtConvertDvtd16toDvtd32
UtConvertDvtd32toDvtd16
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserUnmarshal
CoSetCancelObject
CoRevertToSelf
CoQueryProxyBlanket
CoQueryAuthenticationServices
CoLockObjectExternal
CoInstall
CoGetMarshalSizeMax
CoGetInstanceFromIStorage
CoGetClassVersion
CoGetClassObject
CoDeactivateObject
CoCopyProxy
CLSIDFromProgIDEx
CLIPFORMAT_UserSize
CLIPFORMAT_UserMarshal
CoQueryClientBlanket

shlwapi

StrChrA
StrChrIA
StrChrIW
StrChrW
StrCmpNA
StrCmpNIA
StrCmpNIW
StrCmpNW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrIW
StrStrA
StrStrIA

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ddd
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db6ae8c2354513f1e410c39d3b1a73aa

Code Sign

3d:1f:50:c9:d1:f3:36:8b:41:28:a5:6f:fa:3e:f4:e4Certificate

Extended Key Usages

f3:8c:a1:3c:50:e4:72:9b:f7:cb:b3:48:98:0f:95:b6:10:9c:ad:36Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 14KB - Virtual size: 13KB

.ddd Size: 60KB - Virtual size: 59KB

.data Size: 512B - Virtual size: 108B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

3d:1f:50:c9:d1:f3:36:8b:41:28:a5:6f:fa:3e:f4:e4
Certificate

f3:8c:a1:3c:50:e4:72:9b:f7:cb:b3:48:98:0f:95:b6:10:9c:ad:36
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 14KB - Virtual size: 13KB

.ddd
Size: 60KB - Virtual size: 59KB

.data
Size: 512B - Virtual size: 108B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB