e1a927cbf0f2a161f7dc189afc3b1ccae867709dcbe0ac1b771b77f7fb269643

Sharing

Copy URL Twitter E-mail

General

Target

e1a927cbf0f2a161f7dc189afc3b1ccae867709dcbe0ac1b771b77f7fb269643
Size

2.8MB
MD5

01a3858e5ecd72d5ed624950f11c3be1
SHA1

3bfa0932d0ad99edb9e7de25407848c343b66163
SHA256

e1a927cbf0f2a161f7dc189afc3b1ccae867709dcbe0ac1b771b77f7fb269643
SHA512

fd29b0ce73d220bb6f8f43b281bcfd56afae1c4a79f646d063ec198b5ced146236c63c9c7e4913eabe7206e0d5e1d67ebc8908bda2166f8ffa1bc1e3dc8b3941
SSDEEP

49152:AzR7bgGEw/ko/Dcx4lL7xtEWSpMX2uTHLR0RCmbgzL+Sqh7mdsI3ozug+ZDPiqm4:AzR7bgGEw/ko/DO43tYuTHhqasI3o0DP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1a927cbf0f2a161f7dc189afc3b1ccae867709dcbe0ac1b771b77f7fb269643

Files

e1a927cbf0f2a161f7dc189afc3b1ccae867709dcbe0ac1b771b77f7fb269643
.dll windows x86

31de7c8e0bd00bdcc0437d97537b899e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
lstrcpyW
DeleteFileW
LoadLibraryW
FreeLibrary
WaitForMultipleObjects
CreateEventW
SetEvent
IsBadReadPtr
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
CreateFileA
MapViewOfFile
CreateFileMappingW
SetFilePointer
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetLocalTime
WaitForSingleObject
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
GetVersionExW
MultiByteToWideChar
CreateMutexW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
CreateThread
HeapFree
HeapReAlloc
HeapAlloc
OpenProcess
GetStartupInfoW
CreateProcessW
GetCurrentThread
CreateRemoteThread
GetCurrentProcess
Sleep
OutputDebugStringW
GetTempPathW
WriteFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
WritePrivateProfileStringW
HeapSize
SetEndOfFile
ReadFile
GetFileSize
UnmapViewOfFile
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
GetSystemWindowsDirectoryW
InterlockedCompareExchange
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
InitializeSListHead
TerminateProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent
ResetEvent
ResumeThread
GetTempFileNameW
GetVersion
ExitProcess
GetACP
lstrcmpW
FreeResource
MulDiv
FindNextFileA
FindClose
ReleaseMutex
LocalFree
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
HeapDestroy
GetLastError
RaiseException
CloseHandle
DecodePointer
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
OpenFileMappingW
GetFileSizeEx
CreateFileW
GetStringTypeW
FormatMessageW
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
EncodePointer
SetLastError
TlsAlloc
TlsGetValue

user32

PostQuitMessage
IsWindowVisible
IsIconic
GetWindowTextW
EnumWindows
GetClassNameW
GetWindowLongW
AttachThreadInput
PostMessageW
wsprintfW
PostThreadMessageW
PeekMessageW
GetMessageW
SetWindowLongW
ScreenToClient
SetTimer
EnumDisplayMonitors
GetMonitorInfoW
IsWindow
GetWindowThreadProcessId
FindWindowW
PtInRect
CopyRect
GetCursorPos
GetWindowRect
SetForegroundWindow
GetForegroundWindow
BringWindowToTop
SetWindowPos
SetWinEventHook
MoveWindow
GetWindow
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
IsChild
DestroyWindow
UpdateLayeredWindow
IsZoomed
CharNextW
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
CreateCaret
GetCaretBlinkTime
SetCaretPos
MapWindowPoints
IntersectRect
UnionRect
GetParent
IsRectEmpty
MonitorFromWindow
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
SetPropW
GetPropW
LoadCursorW
LoadImageW
MonitorFromPoint
CharPrevW
DrawTextW
SetRect
DestroyIcon
DrawIconEx
GetIconInfo
wvsprintfW
SetCursor
InflateRect
OffsetRect
SetWindowRgn
MessageBoxW
HideCaret
ShowCaret
ClientToScreen
GetSysColor
GetWindowDC
SetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
RemovePropW
FindWindowExW
IsWindowEnabled

advapi32

RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
GetTokenInformation
RegCreateKeyW
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

shell32

ord165
SHGetSpecialFolderPathW
ShellExecuteExW
ord680

ole32

CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleLockRunning
CoCreateInstance
CoCreateGuid
CoInitialize
CoUninitialize

oleaut32

VariantInit
SafeArrayCreate
SafeArrayPutElement
VariantClear
SysAllocString

shlwapi

StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
SHAutoComplete
StrStrIA
PathRemoveFileSpecW
StrStrIW
PathAppendW
PathCombineW
PathFileExistsW
SHGetValueW
PathFindFileNameW
PathIsDirectoryW
StrCmpIW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

version

VerQueryValueW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

gdiplus

GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipAddPathArc
GdipBitmapLockBits
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipDrawImagePointsI
GdipFillPath
GdipGraphicsClear
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipGetPropertyItemSize

msimg32

AlphaBlend
GradientFill

comctl32

_TrackMouseEvent
ImageList_DrawEx
InitCommonControlsEx
ord17

gdi32

BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
SetWindowOrgEx
GetDeviceCaps
CombineRgn
CreateRectRgnIndirect
CreateRoundRectRgn
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
SetDIBColorTable
TextOutW
ExtTextOutW
CreateDCW
GetDIBits
SetDIBitsToDevice
CreateSolidBrush
CreateCompatibleBitmap

Exports

Exports

CreateTrayClient

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31de7c8e0bd00bdcc0437d97537b899e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

version

wininet

iphlpapi

crypt32

wintrust

gdiplus

msimg32

comctl32

gdi32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 269KB - Virtual size: 268KB

.data Size: 24KB - Virtual size: 42KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 72KB - Virtual size: 72KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 269KB - Virtual size: 268KB

.data
Size: 24KB - Virtual size: 42KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 72KB - Virtual size: 72KB