305265b7bdaeced7055476f27cae58281be2ba504c2640b843f6f59b8edefb7c

Sharing

Copy URL Twitter E-mail

General

Target

305265b7bdaeced7055476f27cae58281be2ba504c2640b843f6f59b8edefb7c
Size

520KB
MD5

3af619a06371895d347d83b67b964bfa
SHA1

1082b73caecde535728f13e16d9a79cebad647c3
SHA256

305265b7bdaeced7055476f27cae58281be2ba504c2640b843f6f59b8edefb7c
SHA512

7f7990e6e60c6f382cd186a9a625fd00cd65e01e1207c320dc0850417934847f9d9f851cd9c63b47b3e2640cdeda595b07fad2328f382230aea3169e0035e451
SSDEEP

6144:xmKvl1SrC+TzDmgjWg2HKvCrxMBehoe9qTpv1DAo981mT8U4DgbF7mV/1se4iw:Enj2qK6sfq9uo981NUz7m

Score

N/A

Malware Config

Signatures

Files

305265b7bdaeced7055476f27cae58281be2ba504c2640b843f6f59b8edefb7c
.dll regsvr32 windows x86

5a18b6b5035b232d342fe9f3701319ca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

wintrust

WinVerifyTrustEx
WTHelperGetKnownUsages
WintrustGetDefaultForUsage
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
TrustIsCertificateSelfSigned

crypt32

CryptMsgEncodeAndSignCTL
CertGetEnhancedKeyUsage
CryptEnumProvidersU
CryptFormatObject
CryptSIPRetrieveSubjectGuid
CertSetCTLContextProperty
CertCreateCTLContext
CertSetCertificateContextProperty
CertFreeCertificateChainEngine
CertVerifyTimeValidity
CertGetCertificateChain
CertCreateCertificateChainEngine
PFXExportCertStore
CryptAcquireContextU
PFXExportCertStoreEx
CertFreeCRLContext
CertGetCRLFromStore
CertEnumCTLsInStore
CryptFindCertificateKeyProvInfo
PFXVerifyPassword
PFXImportCertStore
CertAddCRLContextToStore
CertCreateCertificateContext
CertNameToStrW
CertFindCertificateInStore
CertFreeCertificateContext
CryptEnumOIDInfo
CryptAcquireCertificatePrivateKey
CryptQueryObject
CryptDecodeObject
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertGetNameStringA
CertGetCertificateContextProperty
CertOpenStore
CertAddCertificateContextToStore
CertSaveStore
CertCloseStore
CryptFindLocalizedName
CertEnumPhysicalStore
CertEnumSystemStore
CryptMsgDuplicate
CertGetStoreProperty
CertFindAttribute
CryptMsgVerifyCountersignatureEncoded
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgGetParam
CertGetCTLContextProperty
CryptMsgControl
CryptMsgClose
CertGetPublicKeyLength
CryptFindOIDInfo
CryptInitOIDFunctionSet
CryptGetDefaultOIDDllList
CryptGetDefaultOIDFunctionAddress
CryptFreeOIDFunctionAddress
CertGetValidUsages
CertSetEnhancedKeyUsage
CertGetSubjectCertificateFromStore
CertGetNameStringW
CertAddCTLContextToStore
CertFreeCTLContext
CertEnumCertificatesInStore
CryptEncodeObject
CertFindExtension
CertFreeCertificateChain

msvcrt

wcscat
??2@YAPAXI@Z
??3@YAXPAX@Z
wcscmp
_itow
_except_handler3
_wcsicmp
wcslen
sprintf
_purecall
strchr
printf
strncpy
strtok
swprintf
wcscpy
_wtol
_ltow
iswctype
_wcsnicmp
strtoul
memmove
free
_initterm
malloc
_adjust_fdiv

user32

SetClassLongA
GetWindowRect
CallWindowProcA
GetWindowLongA
SetWindowLongA
GetSysColorBrush
InvalidateRect
FillRect
LoadStringW
SetWindowTextA
GetDlgItemTextW
SetDlgItemTextW
MessageBoxA
MessageBoxW
WinHelpW
PostMessageA
SendDlgItemMessageW
GetWindowTextA
GetDesktopWindow
GetDC
ReleaseDC
WinHelpA
LoadStringA
GetDlgItemTextA
SetDlgItemTextA
SendDlgItemMessageA
GetWindowTextLengthA
GetSystemMetrics
GetSysColor
SystemParametersInfoA
GetWindow
RegisterClipboardFormatA
SetCursor
PeekMessageA
GetFocus
IsWindowEnabled
LoadIconA
GetUpdateRect
BeginPaint
DrawIcon
EndPaint
wsprintfA
MapWindowPoints
SetWindowPos
ShowWindow
GetParent
SendMessageA
SetFocus
DialogBoxParamA
EndDialog
EnableWindow
GetDlgItem
CreateWindowExA
SetWindowTextW
MoveWindow
GetClientRect
ReleaseCapture
SetCapture
GetNextDlgTabItem
DrawFocusRect
UpdateWindow
LoadCursorA

gdi32

CreateCompatibleBitmap
CreateBitmap
GetDeviceCaps
GetTextMetricsA
CreateFontIndirectA
GetBkColor
GetTextExtentPoint32W
GetObjectA
DeleteDC
SetBkColor
BitBlt
CreatePalette
CreateCompatibleDC
SelectObject
SelectPalette
RealizePalette
CreateDIBitmap
DeleteObject

kernel32

DeleteFileA
GetCurrentDirectoryA
InterlockedExchange
RaiseException
CompareFileTime
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetComputerNameA
SystemTimeToFileTime
WriteFile
GetSystemTimeAsFileTime
lstrcmpiA
GetCurrentThread
GetCurrentProcess
CloseHandle
LoadLibraryW
GetCurrentDirectoryW
Sleep
DeleteFileW
CreateFileW
CreateFileA
GetDateFormatW
GetTimeFormatW
GetTimeFormatA
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
LocalFree
FormatMessageA
LocalAlloc
lstrlenW
FreeResource
LockResource
LoadResource
FindResourceA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetLastError
lstrcmpA
SetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
lstrcpyA
lstrlenA
LocalReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcatA
FormatMessageW
GetDateFormatA

comctl32

InitCommonControlsEx
ImageList_Destroy
PropertySheetA
ImageList_LoadImageA
PropertySheetW
ord17

rpcrt4

NdrClientCall2
RpcBindingSetAuthInfoA
RpcRaiseException
UuidToStringA
UuidCreate
NdrClientInitializeNew
NdrPointerBufferSize
NdrGetBuffer
NdrSimpleTypeMarshall
NdrPointerMarshall
NdrSendReceive
NdrConvert
NdrPointerUnmarshall
NdrFreeBuffer
RpcNetworkIsProtseqValidA
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcBindingFree
RpcStringFreeA
RpcEpResolveBinding
RpcMgmtInqServerPrincNameA

advapi32

RegSetValueExW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
DuplicateToken
CryptAcquireContextA
RegCreateKeyExA
RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
CryptGetKeyParam
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey
OpenProcessToken
OpenThreadToken
GetUserNameA
CryptReleaseContext
CryptDestroyKey
CryptGetUserKey
CryptGetProvParam

Exports

Exports

ACUIProviderInvokeUI
CryptUIDlgCertMgr
CryptUIDlgFreeCAContext
CryptUIDlgSelectCA
CryptUIDlgSelectCertificateA
CryptUIDlgSelectCertificateW
CryptUIDlgSelectStoreA
CryptUIDlgSelectStoreW
CryptUIDlgViewCRLA
CryptUIDlgViewCRLW
CryptUIDlgViewCTLA
CryptUIDlgViewCTLW
CryptUIDlgViewCertificateA
CryptUIDlgViewCertificatePropertiesA
CryptUIDlgViewCertificatePropertiesW
CryptUIDlgViewCertificateW
CryptUIDlgViewSignerInfoA
CryptUIDlgViewSignerInfoW
CryptUIFreeCertificatePropertiesPagesA
CryptUIFreeCertificatePropertiesPagesW
CryptUIFreeViewSignaturesPagesA
CryptUIFreeViewSignaturesPagesW
CryptUIGetCertificatePropertiesPagesA
CryptUIGetCertificatePropertiesPagesW
CryptUIGetViewSignaturesPagesA
CryptUIGetViewSignaturesPagesW
CryptUIStartCertMgr
CryptUIWizBuildCTL
CryptUIWizCertRequest
CryptUIWizDigitalSign
CryptUIWizExport
CryptUIWizFreeDigitalSignContext
CryptUIWizImport
DllRegisterServer
DllUnregisterServer
LocalEnroll
RetrievePKCS7FromCA
WizardFree

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a18b6b5035b232d342fe9f3701319ca

Headers

File Characteristics

Imports

wintrust

crypt32

msvcrt

user32

gdi32

kernel32

comctl32

rpcrt4

advapi32

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 207KB

.data Size: 60KB - Virtual size: 57KB

.rsrc Size: 236KB - Virtual size: 234KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 208KB - Virtual size: 207KB

.data
Size: 60KB - Virtual size: 57KB

.rsrc
Size: 236KB - Virtual size: 234KB

.reloc
Size: 12KB - Virtual size: 10KB