356efe00e7d6f616c0e2c0deb006a4ce3f56e3230ed1013822ec35b67202dbda

Sharing

Copy URL Twitter E-mail

General

Target

356efe00e7d6f616c0e2c0deb006a4ce3f56e3230ed1013822ec35b67202dbda
Size

2.2MB
MD5

d5f802a587704674a5f4bd0c8262e6f4
SHA1

bb5afeaa6af710f1bcd033eb9a126ce66c472a38
SHA256

356efe00e7d6f616c0e2c0deb006a4ce3f56e3230ed1013822ec35b67202dbda
SHA512

d3d8a21cecc237f794d625748e5ae2d68bb611ee3d5cdf9ea5280c34ed2a71170864a47490633152502b9659e3571a71295130b8f188986169e4546bed705b87
SSDEEP

49152:GCBWSG5lrqTbVhQ+Sbk49U+Ylu1/fs8MWJNE2fVOQ1:GOb0D99s4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
356efe00e7d6f616c0e2c0deb006a4ce3f56e3230ed1013822ec35b67202dbda

Files

356efe00e7d6f616c0e2c0deb006a4ce3f56e3230ed1013822ec35b67202dbda
.dll windows x86

6a5541ba981ad8b81171923be0335973

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
GetCommandLineW
GetStdHandle
WaitForMultipleObjects
lstrcpyW
LoadLibraryW
GetModuleFileNameW
FreeLibrary
GetCurrentProcess
CreateEventW
WaitForSingleObject
SetEvent
DeleteFileW
ReadDirectoryChangesW
CancelIo
PostQueuedCompletionStatus
GetQueuedCompletionStatus
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFilePointer
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
lstrlenW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetLocalTime
OpenProcess
GetStartupInfoW
CreateProcessW
GetCurrentThreadId
CreateIoCompletionPort
CloseHandle
GetCurrentThread
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileStringW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetVersionExW
FindNextFileW
FindClose
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
CreateRemoteThread
GetCurrentProcessId
CreateMutexW
OutputDebugStringW
GetTempPathW
WriteFile
SetEndOfFile
CreateFileA
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
FindFirstFileW
LocalFree
GetLogicalProcessorInformation
GetThreadPriority
ReadFile
GetFileSizeEx
GetFileSize
CreateFileW
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetSystemWindowsDirectoryW
InterlockedCompareExchange
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
FlushFileBuffers
InitializeSListHead
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsBadReadPtr
ResetEvent
ResumeThread
GetTempFileNameW
GetVersion
ExitProcess
GetACP
lstrcmpW
FreeResource
MulDiv
FindNextFileA
ReleaseMutex
OpenFileMappingW
LoadLibraryExW
IsDebuggerPresent
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
GetCPInfo
TryEnterCriticalSection
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
DeviceIoControl
SetLastError
AreFileApisANSI
GetFileInformationByHandle
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetStringTypeW
FormatMessageW
FindFirstFileExW
GetFileAttributesExW

user32

BringWindowToTop
SetWindowPos
MoveWindow
AttachThreadInput
ScreenToClient
UnhookWinEvent
SetWinEventHook
GetClassNameW
GetWindowTextW
IsIconic
IsWindowVisible
IsWindow
GetWindowLongW
PostQuitMessage
KillTimer
SetTimer
CharLowerBuffW
EnumDisplayMonitors
GetMonitorInfoW
wsprintfW
PostThreadMessageW
PeekMessageW
GetMessageW
GetWindowThreadProcessId
IsWindowEnabled
FindWindowExW
RemovePropW
FindWindowW
PtInRect
CopyRect
GetCursorPos
GetWindowRect
SetForegroundWindow
GetForegroundWindow
SetWindowLongW
GetDC
ReleaseDC
MonitorFromPoint
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
CreateWindowExW
IsChild
DestroyWindow
UpdateLayeredWindow
IsZoomed
CharNextW
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
GetParent
GetWindow
MonitorFromWindow
CharPrevW
DrawTextW
SetRect
DestroyIcon
LoadImageW
DrawIconEx
GetIconInfo
wvsprintfW
SetCursor
InflateRect
OffsetRect
LoadCursorW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
HideCaret
ShowCaret
ClientToScreen
GetSysColor
GetWindowDC
SetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect

advapi32

RegGetValueW
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyW
RegSetValueExW
RegDeleteKeyW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExA

shell32

SHChangeNotify
SHOpenWithDialog
SHGetDesktopFolder
SHGetMalloc
SHGetKnownFolderPath
SHGetFolderLocation
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
ord165

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid

oleaut32

VariantInit
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement

shlwapi

StrCmpNIW
SHSetValueA
SHGetValueA
SHAutoComplete
SHSetValueW
StrStrIA
StrStrIW
PathFileExistsW
PathIsDirectoryW
PathCombineW
PathRemoveFileSpecW
PathAppendW
StrFormatByteSizeW
PathFindFileNameW
SHGetValueW
StrCmpIW
SHDeleteKeyW
SHDeleteValueW
StrTrimA

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

gdiplus

GdipGetImagePixelFormat
GdipDrawImageRectI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateTexture
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetInterpolationMode
GdipGraphicsClear
GdipLoadImageFromFile
GdipDrawEllipseI
GdipAddPathArc
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipDrawImagePointsI
GdipFillPath

msimg32

AlphaBlend
GradientFill

comctl32

_TrackMouseEvent
ImageList_DrawEx
InitCommonControlsEx
ord17

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
Rectangle
RestoreDC
BitBlt
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CombineRgn
CreateRectRgnIndirect
CreateRoundRectRgn
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
SetDIBColorTable
TextOutW
ExtTextOutW
CreateDCW
GetDIBits
SetDIBitsToDevice
CreateSolidBrush

Exports

Exports

CreateTrayClient

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a5541ba981ad8b81171923be0335973

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

version

wininet

iphlpapi

crypt32

wintrust

gdiplus

msimg32

comctl32

gdi32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 297KB - Virtual size: 296KB

.data Size: 27KB - Virtual size: 44KB

.rsrc Size: 413KB - Virtual size: 413KB

.reloc Size: 81KB - Virtual size: 81KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 297KB - Virtual size: 296KB

.data
Size: 27KB - Virtual size: 44KB

.rsrc
Size: 413KB - Virtual size: 413KB

.reloc
Size: 81KB - Virtual size: 81KB