3fe28a57c694b40c3a8648a4ec80c8c88da1b1b3c94a0957e21b989295a9dba3

Sharing

Copy URL

Twitter E-mail

General

Target

3fe28a57c694b40c3a8648a4ec80c8c88da1b1b3c94a0957e21b989295a9dba3
Size

25KB
MD5

670091679820b2b452a16a3d297e18df
SHA1

5f216772426ef2739c4a50474cbfe3774ac0cc87
SHA256

3fe28a57c694b40c3a8648a4ec80c8c88da1b1b3c94a0957e21b989295a9dba3
SHA512

f72c71c389be0404c0cc48bdca5c18f8541a46bf6317113e6591f05f460bd41edb32472e06a1fc958061f2073145e45c9543734b773778b52eaf7a9eaf481789
SSDEEP

384:4FfwjJFkQeV2j+COS8VwkxtY7USY60olX6csWfADOC9e:4FJgTB8VwkxtY7USY60bDOC9e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fe28a57c694b40c3a8648a4ec80c8c88da1b1b3c94a0957e21b989295a9dba3

Files

3fe28a57c694b40c3a8648a4ec80c8c88da1b1b3c94a0957e21b989295a9dba3
.dll windows x64

405de6190803b5924a92bbefe1e75152

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAllocEx
GetCurrentProcess
Sleep
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
QueryPerformanceCounter
RtlCaptureContext
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime

advapi32

RegCloseKey
RegSetValueExA
RegGetValueA
RegOpenKeyExA

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
__std_exception_copy
__std_type_info_destroy_list
__std_exception_destroy
memcpy
memset
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_beginthreadex
terminate
_crt_atexit
_seh_filter_dll

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-stdio-l1-1-0

_getcwd

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

Exports

Exports

PdhAddCounterA
PdhAddCounterW
PdhAddEnglishCounterA
PdhAddEnglishCounterW
PdhAddRelogCounter
PdhBindInputDataSourceA
PdhBindInputDataSourceW
PdhBrowseCountersA
PdhBrowseCountersHA
PdhBrowseCountersHW
PdhBrowseCountersW
PdhCalculateCounterFromRawValue
PdhCloseLog
PdhCloseQuery
PdhCollectQueryData
PdhCollectQueryDataEx
PdhCollectQueryDataWithTime
PdhComputeCounterStatistics
PdhConnectMachineA
PdhConnectMachineW
PdhCreateSQLTablesA
PdhCreateSQLTablesW
PdhEnumLogSetNamesA
PdhEnumLogSetNamesW
PdhEnumMachinesA
PdhEnumMachinesHA
PdhEnumMachinesHW
PdhEnumMachinesW
PdhEnumObjectItemsA
PdhEnumObjectItemsHA
PdhEnumObjectItemsHW
PdhEnumObjectItemsW
PdhEnumObjectsA
PdhEnumObjectsHA
PdhEnumObjectsHW
PdhEnumObjectsW
PdhExpandCounterPathA
PdhExpandCounterPathW
PdhExpandWildCardPathA
PdhExpandWildCardPathHA
PdhExpandWildCardPathHW
PdhExpandWildCardPathW
PdhFormatFromRawValue
PdhGetCounterInfoA
PdhGetCounterInfoW
PdhGetCounterTimeBase
PdhGetDataSourceTimeRangeA
PdhGetDataSourceTimeRangeH
PdhGetDataSourceTimeRangeW
PdhGetDefaultPerfCounterA
PdhGetDefaultPerfCounterHA
PdhGetDefaultPerfCounterHW
PdhGetDefaultPerfCounterW
PdhGetDefaultPerfObjectA
PdhGetDefaultPerfObjectHA
PdhGetDefaultPerfObjectHW
PdhGetDefaultPerfObjectW
PdhGetDllVersion
PdhGetExplainText
PdhGetFormattedCounterArrayA
PdhGetFormattedCounterArrayW
PdhGetFormattedCounterValue
PdhGetLogFileSize
PdhGetLogFileTypeW
PdhGetLogSetGUID
PdhGetRawCounterArrayA
PdhGetRawCounterArrayW
PdhGetRawCounterValue
PdhIsRealTimeQuery
PdhLookupPerfIndexByNameA
PdhLookupPerfIndexByNameW
PdhLookupPerfNameByIndexA
PdhLookupPerfNameByIndexW
PdhMakeCounterPathA
PdhMakeCounterPathW
PdhOpenLogA
PdhOpenLogW
PdhOpenQuery
PdhOpenQueryA
PdhOpenQueryH
PdhOpenQueryW
PdhParseCounterPathA
PdhParseCounterPathW
PdhParseInstanceNameA
PdhParseInstanceNameW
PdhReadRawLogRecord
PdhRelogW
PdhRemoveCounter
PdhResetRelogCounterValues
PdhSelectDataSourceA
PdhSelectDataSourceW
PdhSetCounterScaleFactor
PdhSetCounterValue
PdhSetDefaultRealTimeDataSource
PdhSetLogSetRunID
PdhSetQueryTimeRange
PdhTranslate009CounterW
PdhTranslateLocaleCounterW
PdhUpdateLogA
PdhUpdateLogFileCatalog
PdhUpdateLogW
PdhValidatePathA
PdhValidatePathExA
PdhValidatePathExW
PdhValidatePathW
PdhVbAddCounter
PdhVbCreateCounterPathList
PdhVbGetCounterPathElements
PdhVbGetCounterPathFromList
PdhVbGetDoubleCounterValue
PdhVbGetLogFileSize
PdhVbGetOneCounterPath
PdhVbIsGoodStatus
PdhVbOpenLog
PdhVbOpenQuery
PdhVbUpdateLog
PdhVerifySQLDBA
PdhVerifySQLDBW
PdhWriteRelogSample

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

405de6190803b5924a92bbefe1e75152

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 624B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 84B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 624B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 84B