12ab800ea390efff62997bf1e7ca3dbb5826c689489f25686178082c82c02ad3

Resubmissions

07/08/2023, 16:32

230807-t1yv4shf7w 10

07/08/2023, 16:18

230807-tsa43shf2v 3

Sharing

Copy URL

Twitter E-mail

General

Target

12ab800ea390efff62997bf1e7ca3dbb5826c689489f25686178082c82c02ad3
Size

208KB
MD5

69c8419c5a2084b45f7fb2fe408a124b
SHA1

a3879e22ed34ca2a50c5cddbd13458212fae6f89
SHA256

12ab800ea390efff62997bf1e7ca3dbb5826c689489f25686178082c82c02ad3
SHA512

b97c8b9060c802d84f87491235f04f3b20330f7409fd47e19a21fee943dc8c470dfe62bc84d4662ad647e87695475d85ff7b3cfe2d230cafb32becf99af98e6a
SSDEEP

3072:4QniI+nSHDXewa1OT+Jw18H/sVQ1760yCLI98EXH:RBRjXe90iOjbCspX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12ab800ea390efff62997bf1e7ca3dbb5826c689489f25686178082c82c02ad3

Files

12ab800ea390efff62997bf1e7ca3dbb5826c689489f25686178082c82c02ad3
.dll windows x64

8496a829b3b7401debb8ac7f28fdaa68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcsrchr
_wcsnicmp
memmove
wcschr
_putws
_wcsicmp
isspace
__CxxFrameHandler3
?terminate@@YAXXZ
memcpy
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_wtoi
wcstok_s
??1type_info@@UEAA@XZ
_vsnwprintf
memset

ntdll

RtlCaptureContext
RtlGUIDFromString
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
Sleep
GetCurrentThreadId
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetEnvironmentVariableW
GetLastError
OpenProcess
SetNamedPipeHandleState
GetOverlappedResult
TransactNamedPipe
WaitNamedPipeW
CreateEventW
ResetEvent
DisconnectNamedPipe
IsProcessInJob
WaitForMultipleObjectsEx
GetNamedPipeClientProcessId
CreateNamedPipeW
FindFirstFileW
SetFilePointer
TlsGetValue
CompareFileTime
OutputDebugStringW
WriteFile
TlsSetValue
CopyFileW
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetFileSizeEx
MoveFileW
FindClose
FindNextFileW
GetFileTime
TlsAlloc
CloseHandle
DeleteFileW
GetSystemTime
TlsFree
HeapAlloc
HeapFree
CreateDirectoryW
GetProcessHeap
ConnectNamedPipe
GetFileAttributesW
ReadFile
MultiByteToWideChar
lstrlenW
LocalFree
LocalAlloc
DeviceIoControl
WaitForSingleObject
GetExitCodeThread
CreateThread
lstrlenA
SleepEx
TerminateThread
QueueUserAPC
CompareStringW
SetEvent

advapi32

GetLengthSid
IsValidSid
SetEntriesInAclW
LookupAccountNameW
CopySid
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
EventWrite
SetNamedSecurityInfoW
GetNamedSecurityInfoW

ole32

CreateStreamOnHGlobal

rpcrt4

RpcStringFreeW
NdrClientCall3
UuidCreateSequential
UuidCreate
RpcStringBindingComposeW
RpcBindingFree
RpcBindingFromStringBindingW

shlwapi

SHCreateStreamOnFileW

Exports

Exports

tdActivityAbort
tdActivityAttach
tdActivityBegin
tdActivityCancel
tdActivityClose
tdActivityCloseTransferHandle
tdActivityEnd
tdActivityGetTransferDataFromHandle
tdActivityGetTransferDataSize
tdActivityGetTransferHandleFromData
tdActivityOpen
tdActivityReceiveTransfer
tdActivityResume
tdActivitySendTransfer
tdActivitySuspend
tdCloseAddressRangeSet
tdCloseApplicationConfigurationSettingSet
tdCloseEndpointTarget
tdCloseEndpointTargetPortRangeSet
tdCloseEndpointTargetSet
tdCloseEventCounter
tdCloseEventStream
tdCloseHostingEnvironmentSettingSet
tdCloseLocalResource
tdCloseMeteringTierSet
tdCloseNeighborhood
tdCloseNeighborhoodSet
tdFreeString
tdGetAddressRangeAt
tdGetAddressRangeSet
tdGetAddressRangeSetSize
tdGetApplicationConfigurationSetting
tdGetApplicationConfigurationSettingElementAt
tdGetApplicationConfigurationSettingSet
tdGetApplicationConfigurationSettingSetSize
tdGetCertificateHash
tdGetCertificateStoreName
tdGetConfigurationPath
tdGetDirectAddress
tdGetEndpointSetElementAt
tdGetEndpointSetSize
tdGetEndpointTargetAddress
tdGetEndpointTargetForRoleInstance
tdGetEndpointTargetFromAddress
tdGetEndpointTargetPortRangeSet
tdGetEndpointTargetPortRangeSetElementAt
tdGetEndpointTargetPortRangeSetSize
tdGetEndpointTargetPortSelfManaged
tdGetEndpointTargetProtocol
tdGetEndpointTargetSet
tdGetEventCounter
tdGetEventStream
tdGetHostingEnvironmentSettingByName
tdGetHostingEnvironmentSettingElementAt
tdGetHostingEnvironmentSettingSet
tdGetHostingEnvironmentSettingSetSize
tdGetInputEndpointSet
tdGetInputEndpointTarget
tdGetLoadBalancedPublicAddress
tdGetLocalResource
tdGetLocalResourceAttribute
tdGetLocalResourceName
tdGetMeteringTierAt
tdGetMeteringTierSet
tdGetMeteringTierSetSize
tdGetNeighborhood
tdGetNeighborhoodInfo
tdGetNeighborhoodSet
tdGetResourceRoot
tdGetRoleEntryPoint
tdGetRoleGuid
tdGetRuntimeExecutionEnvironment
tdGetRuntimePackagePath
tdGetSCSCollectiveValue
tdGetSystemConfigurationSetting
tdGetTargetInstancePropagatedSetting
tdGetVipEndpointsSet
tdGlobalObjectNamePrefix
tdIncreaseEventCounter
tdInitializeRuntime
tdInitializeRuntimeEx
tdInitializeRuntimeSecondary
tdLogDebug
tdLogDebugW
tdLogInt
tdLogQuantile
tdLogQuantileSummary
tdLogQuantileSummaryW
tdLogQuantileW
tdLogString
tdLogStringW
tdRefreshRuntime
tdRefreshRuntimeInternal
tdRegisterCallback
tdSelectEndpointTarget
tdStatus
tdStatusEventCounterResource
tdStatusEventStreamResource
tdStatusInputEndpointResource
tdStatusLocalResource
tdStatusOutputEndpointResource
tdUnRegisterCallback
tdUninitializeRuntime
tdVipCollectionGetName
tdVipCollectionSetGetFirst
tdVipCollectionSetGetNext
tdVipEndpointSetGetFirst
tdVipEndpointSetGetNext
tdVipEndpointSetGetVipAddress
vcab

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

8496a829b3b7401debb8ac7f28fdaa68

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

advapi32

ole32

rpcrt4

shlwapi

Exports

Exports

Sections

.text Size: 169KB - Virtual size: 169KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 20KB - Virtual size: 17KB

.reloc Size: 512B - Virtual size: 208B

.text
Size: 169KB - Virtual size: 169KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 512B - Virtual size: 208B