cbe486e8e317833d7bead27632507f14bbcce043c5c48778ca0dd4e1fe674142

Sharing

Copy URL Twitter E-mail

General

Target

cbe486e8e317833d7bead27632507f14bbcce043c5c48778ca0dd4e1fe674142
Size

4.0MB
MD5

a9910ce9c172339e955a38fb243837f3
SHA1

9c22620deefe9119a6f61d819d76c1781fa200b2
SHA256

cbe486e8e317833d7bead27632507f14bbcce043c5c48778ca0dd4e1fe674142
SHA512

32bce94d338fb5cc98be006139c18648ddab17ab0d238779817431b09e039e95d63acb3ba9ab4ba2088d766b23a93ff46c9676910afdb6bbfe09acb96ee84bf4
SSDEEP

98304:hucsXwIbE6fR2CohXUYfNAJzCens6XpzNjjM/Y2:hucsXBI6fR8hXUdJzCAPDjr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cbe486e8e317833d7bead27632507f14bbcce043c5c48778ca0dd4e1fe674142

Files

cbe486e8e317833d7bead27632507f14bbcce043c5c48778ca0dd4e1fe674142
.dll windows x86

1978f14729ae2b3ced219a757037a5b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
GetProcAddress
GetCurrentThread
lstrcatA
lstrcpyA
CreateThread
WritePrivateProfileStringA
GetModuleHandleW
GetSystemDirectoryW
lstrcatW
DisableThreadLibraryCalls
WriteConsoleW
DecodePointer
GetModuleFileNameW
CloseHandle
Sleep
FreeLibrary
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
WriteFile
GetCommandLineW
GetCommandLineA
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
SetStdHandle
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetLastError
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
LoadLibraryExW
InterlockedFlushSList
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileW
GetFileType
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetStringTypeW
GetModuleFileNameA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

wsprintfW
MessageBoxW

advapi32

SystemFunction036
RegCloseKey
RegSetValueExA
RegCreateKeyExA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

ws2_32

inet_addr
htons
bind
socket
WSAStartup
WSASetLastError
listen
recv
accept
send
WSACleanup
shutdown
closesocket

shlwapi

StrCmpNIA
StrNCatA
StrCmpIW
StrCpyW
StrStrIW
PathFileExistsA
PathFileExistsW
StrStrA
StrStrIA

Exports

Exports

CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
MigrateAllDrivers
MigrateSoundEvents
NotifyCallbackData
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOW32DriverCallback
WOW32ResolveMultiMediaHandle
WOWAppExit
WinmmLogoff
WinmmLogon
aux32Message
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
gfxAddGfx
gfxBatchChange
gfxCreateGfxFactoriesList
gfxCreateZoneFactoriesList
gfxDestroyDeviceInterfaceList
gfxEnumerateGfxs
gfxLogoff@0
gfxLogon@4
gfxModifyGfx
gfxOpenGfx
gfxRemoveGfx
joy32Message
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mci32Message
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
mid32Message
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
mod32Message
mxd32Message
sndPlaySoundA
sndPlaySoundW
tid32Message
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
wid32Message
winmmDbgOut
winmmSetDebugLevel
wod32Message

Sections

.text
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.52pojie
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.52pojie
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.52pojie
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.52pojie
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.52pojie
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1978f14729ae2b3ced219a757037a5b4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

version

ws2_32

shlwapi

Exports

Exports

Sections

.text Size: - Virtual size: 89KB

.rdata Size: - Virtual size: 39KB

.data Size: - Virtual size: 11KB

.52pojie Size: - Virtual size: 4KB

.52pojie Size: - Virtual size: 12B

.52pojie Size: - Virtual size: 1.9MB

.52pojie Size: 1024B - Virtual size: 892B

.52pojie Size: 4.0MB - Virtual size: 4.0MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 89KB

.rdata
Size: - Virtual size: 39KB

.data
Size: - Virtual size: 11KB

.52pojie
Size: - Virtual size: 4KB

.52pojie
Size: - Virtual size: 12B

.52pojie
Size: - Virtual size: 1.9MB

.52pojie
Size: 1024B - Virtual size: 892B

.52pojie
Size: 4.0MB - Virtual size: 4.0MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB