74bcda21813bac6d9a87c8b4db8504a07a1a8e31084bb6483678c920c0896dd1

Sharing

Copy URL Twitter E-mail

General

Target

74bcda21813bac6d9a87c8b4db8504a07a1a8e31084bb6483678c920c0896dd1
Size

208KB
MD5

3f3f20d5b13b2123c8f281af87df47c7
SHA1

a1ecb7d86f36ad61db1331162bec5e8c6ff60f94
SHA256

74bcda21813bac6d9a87c8b4db8504a07a1a8e31084bb6483678c920c0896dd1
SHA512

9e541a076ee62b792ac7bd4a8bc2ad819968f694c3e7e7a3a91caa2f3f0fe322facec394ede3be69330591c6ecf030af4aabedfc28af4c0450c8c97037931ae4
SSDEEP

3072:4QniI+nSHDXewa1OT+Jw18H/sVQ1760yCLI98EXs:RBRjXe90iOjbCspc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74bcda21813bac6d9a87c8b4db8504a07a1a8e31084bb6483678c920c0896dd1

Files

74bcda21813bac6d9a87c8b4db8504a07a1a8e31084bb6483678c920c0896dd1
.dll windows x64

8496a829b3b7401debb8ac7f28fdaa68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
_wcsnicmp
memmove
wcschr
_putws
_wcsicmp
isspace
__CxxFrameHandler3
?terminate@@YAXXZ
memcpy
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_wtoi
wcstok_s
??1type_info@@UEAA@XZ
_vsnwprintf
memset

ntdll

RtlCaptureContext
RtlGUIDFromString
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetCurrentThreadId
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetEnvironmentVariableW
GetLastError
OpenProcess
SetNamedPipeHandleState
GetOverlappedResult
TransactNamedPipe
WaitNamedPipeW
CreateEventW
ResetEvent
DisconnectNamedPipe
IsProcessInJob
WaitForMultipleObjectsEx
GetNamedPipeClientProcessId
CreateNamedPipeW
FindFirstFileW
SetFilePointer
TlsGetValue
CompareFileTime
OutputDebugStringW
WriteFile
TlsSetValue
CopyFileW
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetFileSizeEx
MoveFileW
FindClose
FindNextFileW
GetFileTime
TlsAlloc
CloseHandle
DeleteFileW
GetSystemTime
TlsFree
HeapAlloc
HeapFree
CreateDirectoryW
GetProcessHeap
ConnectNamedPipe
GetFileAttributesW
ReadFile
MultiByteToWideChar
lstrlenW
LocalFree
LocalAlloc
DeviceIoControl
WaitForSingleObject
GetExitCodeThread
CreateThread
lstrlenA
SleepEx
TerminateThread
QueueUserAPC
CompareStringW
SetEvent

advapi32

GetLengthSid
IsValidSid
SetEntriesInAclW
LookupAccountNameW
CopySid
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
EventWrite
SetNamedSecurityInfoW
GetNamedSecurityInfoW

ole32

CreateStreamOnHGlobal

rpcrt4

RpcStringFreeW
NdrClientCall3
UuidCreateSequential
UuidCreate
RpcStringBindingComposeW
RpcBindingFree
RpcBindingFromStringBindingW

shlwapi

SHCreateStreamOnFileW

Exports

Exports

tdActivityAbort
tdActivityAttach
tdActivityBegin
tdActivityCancel
tdActivityClose
tdActivityCloseTransferHandle
tdActivityEnd
tdActivityGetTransferDataFromHandle
tdActivityGetTransferDataSize
tdActivityGetTransferHandleFromData
tdActivityOpen
tdActivityReceiveTransfer
tdActivityResume
tdActivitySendTransfer
tdActivitySuspend
tdCloseAddressRangeSet
tdCloseApplicationConfigurationSettingSet
tdCloseEndpointTarget
tdCloseEndpointTargetPortRangeSet
tdCloseEndpointTargetSet
tdCloseEventCounter
tdCloseEventStream
tdCloseHostingEnvironmentSettingSet
tdCloseLocalResource
tdCloseMeteringTierSet
tdCloseNeighborhood
tdCloseNeighborhoodSet
tdFreeString
tdGetAddressRangeAt
tdGetAddressRangeSet
tdGetAddressRangeSetSize
tdGetApplicationConfigurationSetting
tdGetApplicationConfigurationSettingElementAt
tdGetApplicationConfigurationSettingSet
tdGetApplicationConfigurationSettingSetSize
tdGetCertificateHash
tdGetCertificateStoreName
tdGetConfigurationPath
tdGetDirectAddress
tdGetEndpointSetElementAt
tdGetEndpointSetSize
tdGetEndpointTargetAddress
tdGetEndpointTargetForRoleInstance
tdGetEndpointTargetFromAddress
tdGetEndpointTargetPortRangeSet
tdGetEndpointTargetPortRangeSetElementAt
tdGetEndpointTargetPortRangeSetSize
tdGetEndpointTargetPortSelfManaged
tdGetEndpointTargetProtocol
tdGetEndpointTargetSet
tdGetEventCounter
tdGetEventStream
tdGetHostingEnvironmentSettingByName
tdGetHostingEnvironmentSettingElementAt
tdGetHostingEnvironmentSettingSet
tdGetHostingEnvironmentSettingSetSize
tdGetInputEndpointSet
tdGetInputEndpointTarget
tdGetLoadBalancedPublicAddress
tdGetLocalResource
tdGetLocalResourceAttribute
tdGetLocalResourceName
tdGetMeteringTierAt
tdGetMeteringTierSet
tdGetMeteringTierSetSize
tdGetNeighborhood
tdGetNeighborhoodInfo
tdGetNeighborhoodSet
tdGetResourceRoot
tdGetRoleEntryPoint
tdGetRoleGuid
tdGetRuntimeExecutionEnvironment
tdGetRuntimePackagePath
tdGetSCSCollectiveValue
tdGetSystemConfigurationSetting
tdGetTargetInstancePropagatedSetting
tdGetVipEndpointsSet
tdGlobalObjectNamePrefix
tdIncreaseEventCounter
tdInitializeRuntime
tdInitializeRuntimeEx
tdInitializeRuntimeSecondary
tdLogDebug
tdLogDebugW
tdLogInt
tdLogQuantile
tdLogQuantileSummary
tdLogQuantileSummaryW
tdLogQuantileW
tdLogString
tdLogStringW
tdRefreshRuntime
tdRefreshRuntimeInternal
tdRegisterCallback
tdSelectEndpointTarget
tdStatus
tdStatusEventCounterResource
tdStatusEventStreamResource
tdStatusInputEndpointResource
tdStatusLocalResource
tdStatusOutputEndpointResource
tdUnRegisterCallback
tdUninitializeRuntime
tdVipCollectionGetName
tdVipCollectionSetGetFirst
tdVipCollectionSetGetNext
tdVipEndpointSetGetFirst
tdVipEndpointSetGetNext
tdVipEndpointSetGetVipAddress
vcab

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8496a829b3b7401debb8ac7f28fdaa68

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

advapi32

ole32

rpcrt4

shlwapi

Exports

Exports

Sections

.text Size: 169KB - Virtual size: 169KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 20KB - Virtual size: 17KB

.reloc Size: 512B - Virtual size: 208B

.text
Size: 169KB - Virtual size: 169KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 512B - Virtual size: 208B