2572bb99cf295ba0a4cf6bf6d8622578b1f3c15a0326b444598a9847eb9eafca

Sharing

Copy URL Twitter E-mail

General

Target

2572bb99cf295ba0a4cf6bf6d8622578b1f3c15a0326b444598a9847eb9eafca
Size

1.0MB
MD5

87fd5b0889832fac4e947ebc2aa79141
SHA1

9830dfd9642864399f8e48288ff1dcc72c87dbce
SHA256

2572bb99cf295ba0a4cf6bf6d8622578b1f3c15a0326b444598a9847eb9eafca
SHA512

b4f2180bdb4fe809765212e1b3a1076b5b1b7c8e984b39f51615c46fb1eec14bec6c2faae52a2f7e0fbc298744d51b6c22a91cec46ecd1431d6826ad3edde682
SSDEEP

24576:44mTfWekDZrMUsRN1XEBb/oXjSv/MomUEiv5:45jiZrMdab0cVLv5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2572bb99cf295ba0a4cf6bf6d8622578b1f3c15a0326b444598a9847eb9eafca

Files

2572bb99cf295ba0a4cf6bf6d8622578b1f3c15a0326b444598a9847eb9eafca
.dll windows x86

2f12aa61c911bde65599b23a1ddc2267

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenFileMappingA
CreateFileA
WriteFile
GetLastError
WaitNamedPipeA
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetPrivateProfileStringW
Sleep
GetModuleFileNameW
OpenFileMappingW
GetProcAddress
LoadLibraryA
FindFirstFileA
FindClose
FindNextFileA
OutputDebugStringA
GetFileSize
QueryDosDeviceA
GetProcessTimes
OpenProcess
ReadFile
GetLogicalDriveStringsA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcess
GetModuleHandleW
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
lstrcpyW
GetFileAttributesA
GetFileTime
SetUnhandledExceptionFilter
OutputDebugStringW
GetPrivateProfileIntA
CreateFileW
CloseHandle
GetCurrentProcessId
GetModuleFileNameA
CreateFileMappingA
GetLocalTime
GetPrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
UnmapViewOfFile
LocalFree
ConvertFiberToThread
GlobalMemoryStatus
DeleteFiber
GetVersion
InterlockedExchangeAdd
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetCurrentThreadId
MapViewOfFile
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
HeapSize
GetLocaleInfoW
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
RtlUnwind
RaiseException
GetCommandLineA
InterlockedIncrement
EncodePointer
DecodePointer
InterlockedExchange
DeleteCriticalSection
InterlockedCompareExchange
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
ExitThread
CreateThread
ExitProcess

user32

GetParent
GetWindowRect
GetClassNameA
SendMessageW
SendMessageA
GetClassNameW
DispatchMessageW
SetWinEventHook
TranslateMessage
GetMessageW
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
wsprintfW
GetUserObjectInformationW
wsprintfA
EnumChildWindows
FindWindowExW
GetWindowTextW
IsWindow
FindWindowW
MessageBoxW
GetProcessWindowStation

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoCreateGuid
CoCreateInstance
CLSIDFromString
CoInitialize
OleRun
CLSIDFromProgID

oleaut32

SysFreeString
SysAllocString
GetErrorInfo
VariantClear

wininet

HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle

iphlpapi

GetAdaptersInfo

ws2_32

ntohl
ntohs
inet_ntoa
gethostbyname
WSACleanup
WSAStartup
gethostname

psapi

GetProcessImageFileNameA

wpcap

pcap_setfilter
pcap_close
pcap_freealldevs
pcap_open_live
pcap_loop
pcap_compile
pcap_findalldevs

dbghelp

MiniDumpWriteDump

advapi32

CryptReleaseContext
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptGenRandom
CryptAcquireContextW

Exports

Exports

notifyfg

Sections

.text
Size: 714KB - Virtual size: 714KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f12aa61c911bde65599b23a1ddc2267

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

wininet

iphlpapi

ws2_32

psapi

wpcap

dbghelp

advapi32

Exports

Exports

Sections

.text Size: 714KB - Virtual size: 714KB

.rdata Size: 251KB - Virtual size: 250KB

.data Size: 15KB - Virtual size: 30KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 81KB - Virtual size: 80KB

.text
Size: 714KB - Virtual size: 714KB

.rdata
Size: 251KB - Virtual size: 250KB

.data
Size: 15KB - Virtual size: 30KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 81KB - Virtual size: 80KB