48605d4363a4361d7578d3ac9123b1380bd43cb535bfc66648b09a2a0c43238d

Sharing

Copy URL

Twitter E-mail

General

Target

48605d4363a4361d7578d3ac9123b1380bd43cb535bfc66648b09a2a0c43238d
Size

1.1MB
MD5

132e1591df398167c07bda351f713f10
SHA1

0bb704118a9be9bd640a30c6765beeb297f3d808
SHA256

48605d4363a4361d7578d3ac9123b1380bd43cb535bfc66648b09a2a0c43238d
SHA512

a75638a97594745f5dd71a79baa7d733d7ccd43c41e7411ffd62d4a7e399806d918d2b2bfc2aeb228a2c4b7d9152d94027e914e9de6a8e65e010b1c9e24b50cd
SSDEEP

24576:cA2w3tGi02QdluTCeDxQqXftwFgVZFBDyZH4TlO2JhmnTT7unUZ:cA2uNPJk5TinU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48605d4363a4361d7578d3ac9123b1380bd43cb535bfc66648b09a2a0c43238d

Files

48605d4363a4361d7578d3ac9123b1380bd43cb535bfc66648b09a2a0c43238d
.dll windows x86

fde87c2c12c72f17594cb83f5286c95b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiW
HeapAlloc
HeapFree
HeapReAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
lstrcpyA
RtlZeroMemory
HeapDestroy
GetModuleHandleA
GetLastError
HeapCreate
InterlockedIncrement
InterlockedDecrement
HeapSize
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetFilePointer
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcatA
VirtualProtect
ExitProcess
IsBadReadPtr
GetTickCount
GetUserDefaultLCID
LCMapStringA
GetCommandLineA
GetModuleFileNameA
lstrcmpW
GetFileSizeEx
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
VirtualQueryEx
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
lstrcpynW
lstrlenW
RtlMoveMemory
lstrlenA
WriteFile
CreateFileW
FindClose
FindFirstFileA
CloseHandle
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
GetStdHandle
SetHandleCount
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
RtlUnwind
GetVersion
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
FreeLibrary
GetProcAddress
LoadLibraryA
ReadFile
MultiByteToWideChar
IsBadCodePtr
GetProcessHeap

user32

MoveWindow
EnumChildWindows
GetClassNameA
OpenClipboard
GetWindowLongA
SetParent
wsprintfA
GetCursorPos
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowRect
DestroyMenu
MsgWaitForMultipleObjects
PostMessageA
CreateWindowExA
IsWindow
FindWindowA
GetAsyncKeyState
KillTimer
SetTimer
SendMessageA
CharLowerW
SetForegroundWindow
SetWindowRgn
CreateIconFromResource
TrackPopupMenu
CreatePopupMenu
AppendMenuA
EnableMenuItem
IsMenu
SetWindowLongA
wvsprintfA
EmptyClipboard
CloseClipboard
GetClipboardData
MessageBoxA
GetParent

gdi32

DeleteObject

advapi32

CryptSetKeyParam
CryptCreateHash
CryptExportKey
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptDestroyKey
CryptAcquireContextA
CryptImportKey
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
CryptHashData

comdlg32

GetOpenFileNameW
GetSaveFileNameA

ole32

CoInitialize
CoUninitialize
IsEqualGUID
CLSIDFromString
CoInitializeEx
OleRun
CLSIDFromProgID
CoCreateInstance

ws2_32

closesocket
bind
htons
inet_addr
socket
WSAStartup
gethostbyname
accept
recv
setsockopt
send
ioctlsocket
WSAEventSelect
WSACreateEvent
connect
WSACloseEvent
shutdown
WSACleanup
select

oleaut32

VarR8FromCy
SafeArrayGetDim
SafeArrayGetLBound
VariantChangeType
SafeArrayGetUBound
LoadTypeLi
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
VarR8FromBool
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayUnaccessData
VariantInit

atl

ord42
ord47

shell32

StrRStrW
StrRStrIW
StrCmpNIW
StrStrIW
Shell_NotifyIconA
StrStrW
ShellExecuteA

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

wininet

InternetGetConnectedState
InternetOpenA
InternetCloseHandle
InternetOpenW
InternetSetOptionA
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
FindCloseUrlCache
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
InternetGetCookieA
InternetSetCookieA
HttpQueryInfoA
InternetOpenUrlA
InternetReadFile
HttpQueryInfoW
InternetQueryOptionW
HttpSendRequestW

shlwapi

StrToIntW
StrToIntExA
StrToIntExW
StrSpnW

crypt32

CertFreeCertificateContext
CertOpenSystemStoreA
CertFindCertificateInStore
CertVerifyTimeValidity
CertVerifyRevocation
CryptImportPublicKeyInfo
CertCloseStore

iphlpapi

GetAdaptersInfo

winhttp

WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSetCredentials
WinHttpOpen

secur32

EncryptMessage
QueryContextAttributesA
AcquireCredentialsHandleA
InitializeSecurityContextA
FreeContextBuffer
DecryptMessage

winmm

PlaySoundA

Exports

Exports

IDx15
IDx16
IDx17
IDx18
IDx19
IDx20
IDx21
IDx22
IDx23
IDx24
IDx25
IDx26
IDx27
IDx28
IDx29
IDx30
IDx31
IDx32
IDx33
IDx34
IDx35
IDx36
IDx37
IDx38
IDx39
IDx40
IDx41
IDx42
IDx43
IDx44
IDx45
IDx46
IDx47
IDx48
IDx49
IDx50
IDx51
IDx52
IDx53
IDx54
IDx55
IDx56
IDx57
IDx58
IDx60
IDx61
IDx62
IDx63
IDx64
IDx65
IDx66
IDx67
IDx68
IDx69
IDx70

Sections

.text
Size: 948KB - Virtual size: 946KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fde87c2c12c72f17594cb83f5286c95b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comdlg32

ole32

ws2_32

oleaut32

atl

shell32

urlmon

wininet

shlwapi

crypt32

iphlpapi

winhttp

secur32

winmm

Exports

Exports

Sections

.text Size: 948KB - Virtual size: 946KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 148KB - Virtual size: 213KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 32KB - Virtual size: 30KB

.text
Size: 948KB - Virtual size: 946KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 148KB - Virtual size: 213KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 32KB - Virtual size: 30KB