c9925375f11479b46be0c5a8e51f99507f371e5d1df5e722decb744c94c0c379

Sharing

Copy URL Twitter E-mail

General

Target

c9925375f11479b46be0c5a8e51f99507f371e5d1df5e722decb744c94c0c379
Size

1.5MB
MD5

271267fd6b45bbdabb6b718ddf2c2b66
SHA1

7f3ba3a44aa17c743eecf95fe7b367e036f5aba3
SHA256

c9925375f11479b46be0c5a8e51f99507f371e5d1df5e722decb744c94c0c379
SHA512

c94235f4221d28b059bf1a74c3198249eea55c499e57a95758875ac8eccb045106229fb31d4ae9685e2d3faef1f3485f4e5dfdee6581d48818d59ebd4733ca91
SSDEEP

24576:6g0iHiTRmvZusxkmUwzlSMyBg2JQ0iHiTRmvZusxkmUwzlSMyBg2J/:6g0iCAZuDVelSMGg260iCAZuDVelSMGr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9925375f11479b46be0c5a8e51f99507f371e5d1df5e722decb744c94c0c379

Files

c9925375f11479b46be0c5a8e51f99507f371e5d1df5e722decb744c94c0c379
.dll windows x86

657375361f3d5ae2854315394a4d7cc9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatW
LoadLibraryW
GetProcAddress
OutputDebugStringA
EnumLanguageGroupLocalesA
Sleep
SetUnhandledExceptionFilter
GetModuleFileNameW
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter

user32

GetKeyboardLayout
wsprintfA

msvcp140

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_id
_Thrd_join
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xlength_error@std@@YAXPBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_do_broadcast_at_thread_exit
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

shlwapi

PathRemoveFileSpecW
PathStripPathW
StrCmpIW

imm32

ImmGetDescriptionW

vcruntime140

_except_handler4_common
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memset
memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_beginthreadex

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-convert-l1-1-0

_itoa_s

Exports

Exports

SMCInit
SMCUnInit
_cJSON_AddArrayToObject@0
_cJSON_AddBoolToObject@0
_cJSON_AddFalseToObject@0
_cJSON_AddItemReferenceToArray@0
_cJSON_AddItemReferenceToObject@0
_cJSON_AddItemToArray@0
_cJSON_AddItemToObject@0
_cJSON_AddItemToObjectCS@0
_cJSON_AddNullToObject@0
_cJSON_AddNumberToObject@0
_cJSON_AddObjectToObject@0
_cJSON_AddRawToObject@0
_cJSON_AddStringToObject@0
_cJSON_AddTrueToObject@0
_cJSON_Compare@0
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@0
_cJSON_CreateBool@0
_cJSON_CreateDoubleArray@0
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@0
_cJSON_CreateIntArray@0
_cJSON_CreateNull@0
_cJSON_CreateNumber@0
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@0
_cJSON_CreateRaw@0
_cJSON_CreateString@0
_cJSON_CreateStringArray@0
_cJSON_CreateStringReference@0
_cJSON_CreateTrue@0
_cJSON_Delete@0
_cJSON_DeleteItemFromArray@0
_cJSON_DeleteItemFromObject@0
_cJSON_DeleteItemFromObjectCaseSensitive@0
_cJSON_DetachItemFromArray@0
_cJSON_DetachItemFromObject@0
_cJSON_DetachItemFromObjectCaseSensitive@0
_cJSON_DetachItemViaPointer@0
_cJSON_Duplicate@0
_cJSON_GetArrayItem@0
_cJSON_GetArraySize@0
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@0
_cJSON_GetObjectItem@0
_cJSON_GetObjectItemCaseSensitive@0
_cJSON_GetStringValue@0
_cJSON_HasObjectItem@0
_cJSON_InitHooks@0
_cJSON_InsertItemInArray@0
_cJSON_IsArray@0
_cJSON_IsBool@0
_cJSON_IsFalse@0
_cJSON_IsInvalid@0
_cJSON_IsNull@0
_cJSON_IsNumber@0
_cJSON_IsObject@0
_cJSON_IsRaw@0
_cJSON_IsString@0
_cJSON_IsTrue@0
_cJSON_Minify@0
_cJSON_Parse@0
_cJSON_ParseWithLength@0
_cJSON_ParseWithLengthOpts@0
_cJSON_ParseWithOpts@0
_cJSON_Print@0
_cJSON_PrintBuffered@0
_cJSON_PrintPreallocated@0
_cJSON_PrintUnformatted@0
_cJSON_ReplaceItemInArray@0
_cJSON_ReplaceItemInObject@0
_cJSON_ReplaceItemInObjectCaseSensitive@0
_cJSON_ReplaceItemViaPointer@0
_cJSON_SetNumberHelper@0
_cJSON_SetValuestring@0
_cJSON_Version@0
_cJSON_free@0
_cJSON_malloc@0
getManufacturer
getModel
getOsVersionString
getProcessPerformance
getSystemCpuTime
getTemperature
getThreadPerformance
getThreadPerformanceWithStackInfo
getThreadStack
init_thor
isProcessExist
ping_thor
releaseCppStringFFI
releaseStringArrayFFI
releeaseThreadBasicPerformanceListFFI
releeaseThreadExtendPerformanceListFFI
symCleanupCurrentProcess
symInitializeCurrentProcess
testCallapi
uninit_thor

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

657375361f3d5ae2854315394a4d7cc9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

shlwapi

imm32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 2KB - Virtual size: 2KB