99a8664aa92768336dad905b36def6f92dd74fadd368524deaec4e3f56eda5e4

Sharing

Copy URL Twitter E-mail

General

Target

99a8664aa92768336dad905b36def6f92dd74fadd368524deaec4e3f56eda5e4
Size

9.1MB
MD5

f2595003915bf35f22b7fb7b8ea4c73c
SHA1

317034957ced018248c83a611fa1fccbd1fa97f5
SHA256

99a8664aa92768336dad905b36def6f92dd74fadd368524deaec4e3f56eda5e4
SHA512

44c432a9c91968d1584fbc72cfa8cebbffb545b3ef932c196798c4fd5fdc2bdd1462a7bd4d879baaa247f109f22f2952735719149920a9a7e457793a1e1f1a08
SSDEEP

98304:0VZDoAgZn+yDu2fV1n/DylE/5G+3K2CNs7i7PbzpsRquK7fCHffeMXqYxPfyZF0h:0tE/5G+ibzpzuYfC/flrfG8X0lnN3xM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99a8664aa92768336dad905b36def6f92dd74fadd368524deaec4e3f56eda5e4

Files

99a8664aa92768336dad905b36def6f92dd74fadd368524deaec4e3f56eda5e4
.dll windows x86

3d2836c2ff5c52036c4660c827d30588

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateEventW
OpenMutexW
CreateFileMappingW
CreateThread
ReleaseMutex
WaitForSingleObject
GetModuleHandleW
GetProcAddress
DecodePointer
InitializeCriticalSectionAndSpinCount
GetACP
OpenProcess
GetTickCount64
TerminateProcess
MoveFileExW
GetLocalTime
IsProcessorFeaturePresent
ReadFile
PeekNamedPipe
CreateProcessW
GetFileAttributesW
SwitchToThread
GetModuleHandleA
GetSystemTimeAsFileTime
CreateFileW
SetEvent
OpenThread
ReleaseSemaphore
CreateSemaphoreW
LoadLibraryW
FreeLibrary
GetSystemWow64DirectoryW
SetLastError
GetCurrentDirectoryW
GetSystemInfo
DeleteFileW
OpenEventW
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
GlobalUnlock
TlsGetValue
DeleteCriticalSection
GlobalLock
GlobalFree
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
EnterCriticalSection
TlsSetValue
GetModuleFileNameA
GetCurrentProcessId
GlobalAddAtomW
GlobalGetAtomNameW
DebugBreak
GetTickCount
CloseHandle
ResumeThread
GetCurrentProcess
InitializeCriticalSectionEx
SetThreadPriority
GetCurrentThread
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
LocalFree
LocalAlloc
CreateMutexW
GetStartupInfoW
CopyFileW
GetSystemTime
WriteFile
SetFilePointer
SetFileAttributesW
GetTempFileNameW
GetFileSize
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
FindFirstFileW
GlobalHandle
LoadLibraryA
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
GetCurrentThreadId
GetSystemDirectoryW
GetTempPathW
GetLastError
Sleep
WideCharToMultiByte
MultiByteToWideChar
FindClose
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetEndOfFile
HeapSize
SetStdHandle
GetFileSizeEx
SetFilePointerEx
SetConsoleCtrlHandler
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
CompareStringW
GetTimeFormatW
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
DuplicateHandle
ExitThread
FormatMessageW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryDosDeviceW
RemoveDirectoryW
GetLogicalDriveStringsW
FileTimeToSystemTime
CreateDirectoryW
GetProcessId
GetFileAttributesExW
GetFileTime
GetExitCodeProcess
lstrlenW
OutputDebugStringW
TlsAlloc
TlsFree
SizeofResource
LockResource
LoadResource
FindResourceW
HeapFree
GetFullPathNameW
lstrlenA
HeapAlloc
GetProcessHeap
LoadLibraryExW
GetVersionExW
GetWindowsDirectoryW
VirtualFree
VirtualAlloc
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
SetNamedPipeHandleState
WaitNamedPipeW
MulDiv
ResetEvent
lstrcatW
lstrcpyW
IsDebuggerPresent
SetUnhandledExceptionFilter
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GlobalReAlloc
GetWindowsDirectoryA
CreateFileA
CreateFileMappingA
OpenFileMappingA
OpenWaitableTimerW
SetWaitableTimer
CreateWaitableTimerW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetExitCodeThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
GetLocaleInfoEx
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetEnvironmentVariableW
GetFileInformationByHandle
GetFileType
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetTimeZoneInformation
HeapReAlloc
GetDateFormatW
GetModuleFileNameW

user32

GetWindowLongW
GetWindowTextW
SendInput
SetWindowsHookExW
GetClassNameW
UnhookWindowsHookEx
GetForegroundWindow
GetAsyncKeyState
CallNextHookEx
keybd_event
GetFocus
PostMessageW
GetMessageExtraInfo
MoveWindow
ShowWindow
InvalidateRect
DestroyWindow
GetWindowTextLengthW
GetGUIThreadInfo
SetRectEmpty
ReleaseDC
IsIconic
SetClipboardData
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
MonitorFromWindow
SetWindowPos
GetDC
MonitorFromPoint
CharNextW
LoadStringW
WindowFromPoint
wsprintfW
MsgWaitForMultipleObjectsEx
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
AppendMenuW
GetClientRect
SetCursor
SetCapture
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
ClientToScreen
SetTimer
TrackPopupMenu
GetWindowPlacement
GetWindow
NotifyWinEvent
CreatePopupMenu
ScreenToClient
InsertMenuItemW
CallWindowProcW
PtInRect
DrawTextW
UpdateLayeredWindow
IntersectRect
SubtractRect
SetCaretPos
GetCaretPos
wvsprintfW
FillRect
OffsetRect
DestroyIcon
GetKeyboardLayoutList
GetProcessWindowStation
GetUserObjectInformationW
SetRect
GetClassLongW
RedrawWindow
SetClassLongW
GetCursor
SetWindowRgn
SetCursorPos
InflateRect
CopyRect
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
SetScrollInfo
EqualRect
DrawIconEx
IsRectEmpty
PostQuitMessage
GetAncestor
KillTimer
FindWindowW
RegisterHotKey
UnregisterHotKey
GetWindowThreadProcessId
SetWindowLongW
GetKeyboardState
MessageBoxW
GetWindowRect
IsWindowVisible
SendMessageW
GetTopWindow
GetDesktopWindow
GetParent
mouse_event
GetMenuItemID
GetKeyState
RegisterClassExW
UnregisterClassW
DefWindowProcW
CreateWindowExW
RemovePropW
GetClassInfoW
RegisterClassW
LoadCursorW
FindWindowExW
GetPropW
ReplyMessage
SetPropW
PeekMessageW
LoadImageW
SystemParametersInfoW
GetSystemMetrics
EndDialog
LoadIconW
SetForegroundWindow
RegisterWindowMessageW
SendMessageTimeoutW
EnumWindows
GetMessageW
DispatchMessageW
TranslateMessage
PostThreadMessageW
IsWindow
DestroyMenu
GetCursorPos

gdi32

CreateCompatibleBitmap
GetDeviceCaps
StretchBlt
BitBlt
CreateDCW
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateFontIndirectW
GetFontData
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
MoveToEx
LineTo
GetStockObject
SelectObject
CreateDIBSection
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
DeleteObject
SelectClipRgn
CreatePen
CreateRectRgn
GetClipRgn
GetTextExtentExPointW
GetFontUnicodeRanges
SetBkColor
Rectangle
CombineRgn
OffsetRgn
ExtCreateRegion
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchDIBits
SetMapMode
CreateFontW

advapi32

CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetLengthSid
AddAccessAllowedAceEx
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
LookupAccountSidW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
RegisterEventSourceW
RegQueryValueW
DeregisterEventSource
CryptEnumProvidersW

imm32

ImmLockIMCC
ImmLockIMC
ImmUnlockIMC
ImmAssociateContextEx
ImmUnlockIMCC
ImmDisableIME
ImmCreateIMCC
ImmGetHotKey
ImmNotifyIME
ImmGetIMCCSize
ImmReSizeIMCC
ImmGenerateMessage

msimg32

AlphaBlend
GradientFill
TransparentBlt

oleacc

AccessibleObjectFromWindow
LresultFromObject

winhttp

WinHttpCrackUrl
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

ws2_32

WSACleanup
WSAGetLastError
recv
send
WSASetLastError
closesocket

bcrypt

BCryptGenRandom

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeExtension
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
NotifyIMEComMsg

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 241KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d2836c2ff5c52036c4660c827d30588

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

imm32

msimg32

oleacc

winhttp

crypt32

ws2_32

bcrypt

Exports

Exports

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 241KB - Virtual size: 443KB

.rsrc Size: 634KB - Virtual size: 633KB

.reloc Size: 348KB - Virtual size: 347KB

.text
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 241KB - Virtual size: 443KB

.rsrc
Size: 634KB - Virtual size: 633KB

.reloc
Size: 348KB - Virtual size: 347KB