bca25bfb31c96100c75450c3532446cd23a935c3c60c1195b3e076be67f29c77

Sharing

Copy URL Twitter E-mail

General

Target

bca25bfb31c96100c75450c3532446cd23a935c3c60c1195b3e076be67f29c77
Size

3.3MB
MD5

da104f97dcc2130be0155545312f9895
SHA1

37428da0a25ff77a65aebfc6b7c059e1506b30a9
SHA256

bca25bfb31c96100c75450c3532446cd23a935c3c60c1195b3e076be67f29c77
SHA512

b1bbea1689b15798a781b06be1df8d4d7258b09f0f86d6275d9212fbb71985dc3a80358c801dba952cfbbbf880785f44ac32f0e43bb70a60d665c5f973b45729
SSDEEP

49152:cLeffECl8vp+ZRXv9EW482CAVPVeqcEq1cdngK74tzDCJZLkvsvF7DTYk50745wy:cBVPUqcEq1cts3CJZoveUk507/ivNO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bca25bfb31c96100c75450c3532446cd23a935c3c60c1195b3e076be67f29c77

Files

bca25bfb31c96100c75450c3532446cd23a935c3c60c1195b3e076be67f29c77
.dll windows x86

282d2ab8bec3164cb397912f71c7902e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGenerateMessage
ImmReSizeIMCC
ImmUnlockIMCC
ImmLockIMCC
ImmCreateIMCC
ImmUnlockIMC
ImmLockIMC

shlwapi

PathFileExistsW
PathFileExistsA

kernel32

DosDateTimeToFileTime
TlsGetValue
TlsSetValue
FindResourceW
GetFileAttributesW
MulDiv
lstrcpyW
LCMapStringW
GetCurrentThread
GetThreadContext
SuspendThread
ResumeThread
GetModuleFileNameA
lstrlenW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
GetSystemDirectoryW
GetPrivateProfileStringA
SetEndOfFile
SetFilePointerEx
CreateFileA
DeleteFileA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
GetModuleHandleW
LoadLibraryW
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
QueryPerformanceCounter
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetCurrentDirectoryW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LocalFileTimeToFileTime
PeekNamedPipe
GetDriveTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetFileType
GetModuleHandleExW
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
ExitProcess
GetSystemTime
FormatMessageA
LoadLibraryA
GetFullPathNameW
GetFullPathNameA
GetTempPathA
GetFileAttributesA
UnlockFile
LockFileEx
LockFile
FlushFileBuffers
SetFilePointer
AreFileApisANSI
InterlockedIncrement
FindResourceExW
OutputDebugStringW
WinExec
ReadProcessMemory
VirtualFree
VirtualAlloc
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsAlloc
CreateEventW
SetLastError
EncodePointer
TryEnterCriticalSection
SetFileTime
ResetEvent
QueryPerformanceFrequency
CreateThread
TerminateThread
Sleep
CloseHandle
SizeofResource
LoadResource
LockResource
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
SetUnhandledExceptionFilter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
GetVersionExW
MoveFileExW
CopyFileW
FindNextFileW
FindFirstFileW
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
GetWindowsDirectoryW
GetTempPathW
CreateProcessW
lstrcmpiW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
FindClose
ReadFile
GetFileSize
WaitForSingleObject
GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
GetCurrentProcessId
GetTickCount
GetLocalTime

user32

GetKeyState
CharNextW
DrawTextW
GetCapture
GetLastInputInfo
FindWindowW
GetCaretPos
PostMessageW
GetWindowThreadProcessId
SetWindowPos
IsWindow
IsWindowVisible
BringWindowToTop
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
CharLowerW
GetFocus
keybd_event
GetSystemMetrics
GetForegroundWindow
GetWindowRect
GetWindowLongW
SetWindowLongW
GetDesktopWindow
GetGUIThreadInfo
FindWindowExW
GetClassNameW
SetTimer
KillTimer
SetRect
SendMessageW
DestroyWindow
RegisterWindowMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
LoadCursorW
GetDC
ReleaseDC
PtInRect
SystemParametersInfoW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayMonitors
ClientToScreen
WindowFromPoint
LoadStringW
ScreenToClient
SendMessageTimeoutW
ShowWindow
CreateDialogParamW
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
SetWindowTextW
SetCursor
IsIconic
InvalidateRect
CallWindowProcW
MoveWindow
GetDlgItemTextW
SetFocus
MessageBoxW
SetDlgItemInt
GetDlgItemInt
GetAsyncKeyState
ReleaseCapture
MessageBeep
ToAscii
SetCapture
OffsetRect
UpdateLayeredWindow
BeginPaint
EndPaint
SetRectEmpty
UnionRect
GetClientRect
GetParent
SetMenuInfo
TrackPopupMenu
DeleteMenu
RemoveMenu
ModifyMenuW
InsertMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
CreateMenu
GetCursorPos
FillRect

gdi32

CreateDCW
TextOutW
GetDIBits
GetObjectW
BitBlt
CreateDIBSection
SetTextColor
SetBkMode
GetDeviceCaps
CreateBitmap
MoveToEx
LineTo
CreatePen
CreateCompatibleBitmap
GetTextExtentPoint32W
GetTextExtentPointW
ExcludeClipRect
CreateSolidBrush
CreateFontW
EnumFontsW
CreateICW
GetPixel
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
GetStockObject

advapi32

SetTokenInformation
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
LookupAccountNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegSetValueW
RegCreateKeyW
RegDeleteKeyW
GetTokenInformation
GetSecurityDescriptorSacl
LookupAccountSidW
CreateProcessAsUserW
RegDeleteValueW
ImpersonateLoggedOnUser
RevertToSelf
SetSecurityInfo
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
RegCreateKeyExW
DuplicateTokenEx
EqualSid

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW
SHAppBarMessage

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CoInitialize

psapi

GetModuleFileNameExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdiplus

GdipFillRectangleI
GdipGetGenericFontFamilySansSerif
GdipCloneBitmapAreaI
GdipCreateBitmapFromStream
GdipGetImageRawFormat
GdipDisposeImage
GdipCloneImage
GdipFillPath
GdipDrawPath
GdipDrawLineI
GdipSetImageAttributesColorKeys
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipSetPenDashStyle
GdipAddPathArcI
GdipAddPathLineI
GdipDeleteFont
GdipCreateFont
GdipCreateFontFamilyFromName
GdipDrawString
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDrawLine
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCloneFontFamily
GdipSetStringFormatLineAlign
GdipDeleteBrush
GdipCloneBrush
GdipAlloc
GdipDisposeImageAttributes
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipPrivateAddFontFile
GdipGetFontCollectionFamilyCount
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipFree
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipGetFontSize
GdipGetFamily
GdipDeleteFontFamily
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipGetFontCollectionFamilyList
GdipCloneFont
GdipDrawImageRectI
GdipCreateStringFormat
GdipCreatePen1
GdipSetStringFormatAlign
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateSolidFill

dbghelp

SymGetModuleBase64
SymFunctionTableAccess64
EnumerateLoadedModules64
StackWalk64
SymInitialize

Exports

Exports

CandWndProc
CompWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 810KB - Virtual size: 809KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

282d2ab8bec3164cb397912f71c7902e

Headers

DLL Characteristics

File Characteristics

Imports

imm32

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

psapi

userenv

gdiplus

dbghelp

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 367KB - Virtual size: 367KB

.data Size: 58KB - Virtual size: 94KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 810KB - Virtual size: 809KB

.reloc Size: 87KB - Virtual size: 87KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 367KB - Virtual size: 367KB

.data
Size: 58KB - Virtual size: 94KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 810KB - Virtual size: 809KB

.reloc
Size: 87KB - Virtual size: 87KB