e91e6b86ccedeccaf93797643f39307ebb053706263d0f4941f9529fa494de40

Sharing

Copy URL Twitter E-mail

General

Target

e91e6b86ccedeccaf93797643f39307ebb053706263d0f4941f9529fa494de40
Size

1.5MB
MD5

ecb5b8b672f83e7d3e23718a29b493b3
SHA1

b6c21b3d49422bc890068ed8b1fa591c2e556091
SHA256

e91e6b86ccedeccaf93797643f39307ebb053706263d0f4941f9529fa494de40
SHA512

f477066640d19d9a842eb7535f83332c287965bb98109ed3dc9636485cb09fe934eb6d9174fc2ae482bdfddf552c934bba9f6beca1e306ed4eb8a172593117f9
SSDEEP

24576:OIzkQ2OJ+KpP1Y3R6FPKwYSFvX1YQxyj+0IrIos0HHmavCXPaYOmQxrSRw6l:VPNQ6FCwYavFNrlHHmavCXPaYgrSRw6l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e91e6b86ccedeccaf93797643f39307ebb053706263d0f4941f9529fa494de40

Files

e91e6b86ccedeccaf93797643f39307ebb053706263d0f4941f9529fa494de40
.dll windows x86

ac5e57a1b9aee6f98e660288a44864fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAGetLastError
closesocket
WSASetLastError
send
recv

crypt32

CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertDuplicateCertificateContext

kernel32

GetFileSizeEx
DeleteFileW
SetStdHandle
InitializeCriticalSection
ReadFile
DecodePointer
CloseHandle
RaiseException
GetLastError
CreatePipe
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateProcessW
GetStartupInfoW
OpenMutexA
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleExW
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
DeleteFiber
WideCharToMultiByte
ConvertFiberToThread
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FileTimeToSystemTime
GetConsoleCP
FlushFileBuffers
SystemTimeToTzSpecificLocalTime
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileAttributesExW
CreateDirectoryW
GetStringTypeW
GetTimeZoneInformation
WriteConsoleW
CreateFileW
ExitProcess
SetConsoleCtrlHandler
LCMapStringW
CompareStringW
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetModuleFileNameW
GetCurrentThreadId
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
OutputDebugStringW
LocalFree
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
LoadLibraryExW
SetEndOfFile

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW

oleaut32

VariantClear

Exports

Exports

EX_CalFactor
EX_SaveRandom
MyShamirPriKey
SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_CheckLicense
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCExportSessionKey
SKF_ECCSignData
SKF_ECCVerify
SKF_ECCexSignData
SKF_ECCexVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExBackupApp
SKF_ExRestoreApp
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtECCexPriKeyOperation
SKF_ExtECCexPubKeyOperation
SKF_ExtECCexSign
SKF_ExtGenECCExKeyPair
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_GenECCExKeyPair
SKF_GenECCKeyPair
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKeyWithECC
SKF_GenerateSM3_OTP
SKF_GetContainerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_GetSymmKey
SKF_ImportAllCertEx
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportECCexKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_ModelInit
SKF_OpenApplication
SKF_OpenContainer
SKF_RSAExportSessionKey
SKF_RSASignData
SKF_RSAVerify
SKF_ReadFile
SKF_SetLabel
SKF_SetLicense
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteFile

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac5e57a1b9aee6f98e660288a44864fc

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

kernel32

user32

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 326KB - Virtual size: 326KB

.data Size: 27KB - Virtual size: 38KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 45KB - Virtual size: 44KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 326KB - Virtual size: 326KB

.data
Size: 27KB - Virtual size: 38KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 45KB - Virtual size: 44KB