685b189151c08dcc3c444b2de9843458154c820afd4fca50a7597f41b85e9376

Sharing

Copy URL Twitter E-mail

General

Target

685b189151c08dcc3c444b2de9843458154c820afd4fca50a7597f41b85e9376
Size

127KB
MD5

2c078ec04b67814e729067343d4d35aa
SHA1

5e2d8fa774d64291009b4e4fffb7ce3113274bab
SHA256

685b189151c08dcc3c444b2de9843458154c820afd4fca50a7597f41b85e9376
SHA512

d2045c824af3971f72117602f46f02c2ecd8b971002e9ad6b1bbf9811365f24e3c26ad9a01d92767044c37795f57a4df7e7a8e9ee76c2811a74dea4791572586
SSDEEP

1536:9Q26TFaU0kq5sXIi7u7P/jYdJHLUmlQFTUxaqHNshOo1C+bsWEocdUxeKqPSYI0:S9QTiImu7KrUQQFAQcDo1mUxeKqP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
685b189151c08dcc3c444b2de9843458154c820afd4fca50a7597f41b85e9376

Files

685b189151c08dcc3c444b2de9843458154c820afd4fca50a7597f41b85e9376
.dll windows x86

f3ba6895ab0abfcf3eedfc1f4dfc5571

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind
RtlNtStatusToDosError
NtClose
NtCreateFile

kernel32

WriteConsoleW
FlushFileBuffers
SetFilePointerEx
ReadFile
WriteFile
SetLastError
CreateFileW
lstrcatW
CreateDirectoryW
GetLastError
lstrcpyW
RemoveDirectoryW
DeviceIoControl
DeleteFileW
CloseHandle
GetCurrentProcessId
GetFileAttributesW
SetFileAttributesW
SetFilePointer
Sleep
lstrlenW
GetSystemDirectoryW
lstrcpynW
QueryDosDeviceW
DefineDosDeviceW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
LCMapStringW
GetFileType
GetStdHandle
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue

user32

BroadcastSystemMessageW
SendMessageTimeoutW

shell32

SHChangeNotify

safebase

Adler32
MakeSafeHead
ResetNetworkHardware
NormalPattern
DeleteDirs
OpenVolumeDriver
FlushVolume
FormUNCFileName
UnLockDevice
UnMountDevice
LockDevice
DelDriverFile
RemoveDriver
EncryptBuffer
StartDriver
SetInstPath
SetMiniFilterInstance
InstMiniFlterDriver
DLWow64RevertWow64FsRedirection
DLWow64DisableWow64FsRedirection
InitCipher
CheckSafeHead
ProbeDiskChanged
FormatVolume
GetFreeDriveLetter
RenameFile
ParseFileName
DecryptBuffer
StopDriver
GenRandKey
GetTempDirectory

Exports

Exports

BoxAddHidePid
BoxAddPassFile
BoxAddPassPid
BoxAddPermitPid
BoxAddPermitProcess
BoxAddProtPid
BoxBackEncryptKey
BoxBreakNetwork
BoxCheckImgPwd
BoxClearHidePid
BoxClearPassFile
BoxClearPassPid
BoxClearPermitPid
BoxClearPermitProcess
BoxClearProtPid
BoxClearRemapData
BoxCreateImage
BoxDelHidePid
BoxDelPassPid
BoxDelPermitPid
BoxDelProtPid
BoxDisableMount
BoxDiskFullNotify
BoxDiskFullNotifyStart
BoxDiskFullNotifyStop
BoxDriverIsRunning
BoxEnableMount
BoxGetCreatedVolume
BoxGetMountName
BoxGetMountedVolume
BoxGetVolumeInfo
BoxInjectDLL
BoxInstDriver
BoxIsHidePid
BoxIsMounted
BoxIsMountedByName
BoxIsPassPid
BoxIsPermitPid
BoxIsProtPid
BoxLoadDriver
BoxMountImage
BoxMountPartition
BoxReadBoxHead
BoxRecoverNetwork
BoxRestEncryptKey
BoxSetHook
BoxSetImgSN
BoxSetRemapping
BoxStartRelate
BoxStopRelate
BoxUnInstDriver
BoxUnLoadDriver
BoxUnMountImg
BoxWriteBoxHead
ExpandImgSize

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3ba6895ab0abfcf3eedfc1f4dfc5571

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

shell32

safebase

Exports

Exports

Sections

.text Size: 86KB - Virtual size: 85KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB