600580562acb8eca024133a67584702a0fc35d498b97a157eb276cd586f2ca8b

Sharing

Copy URL Twitter E-mail

General

Target

600580562acb8eca024133a67584702a0fc35d498b97a157eb276cd586f2ca8b
Size

651KB
MD5

72ba726372e58bf86cacfe8f529d3ace
SHA1

d014d73a9f83570bacebe4a6134ea55f9fd5ad8c
SHA256

600580562acb8eca024133a67584702a0fc35d498b97a157eb276cd586f2ca8b
SHA512

68d60a4279a71bb80ad3d76a82254b944b96d73345645b9261c6266814007a4aad0f07a0488f56b8a0a760ccf0da4fdcc12f3e41c94aa7876ac0cc5fc69e2ab4
SSDEEP

12288:RCkBHokkoYPbmzyv/Q4X6asYPBRPTeuBRNhezPSf5MeIhjoqQO+P/JT1333xbWpQ:wk9do5j333kpcaP6dJXXXvGjqT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
600580562acb8eca024133a67584702a0fc35d498b97a157eb276cd586f2ca8b

Files

600580562acb8eca024133a67584702a0fc35d498b97a157eb276cd586f2ca8b
.dll regsvr32 windows x86

33db6a2e0c8b0b1712938324307d0d1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocalTime
OpenMutexW
SystemTimeToFileTime
FileTimeToSystemTime
GlobalAlloc
WaitForSingleObject
TerminateProcess
CreateDirectoryW
GlobalFree
SetFilePointer
lstrcmpA
LocalFileTimeToFileTime
lstrlenA
lstrcpyA
IsBadReadPtr
GetCurrentDirectoryA
CreateFileA
DuplicateHandle
lstrcmpiA
SetFileTime
CreateMutexW
ReleaseMutex
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetVersionExW
GetSystemInfo
CreateDirectoryA
GetCurrentThreadId
GetCurrentProcess
ResumeThread
GetModuleHandleExW
GetModuleFileNameA
WideCharToMultiByte
GetTickCount
CreateFileW
CloseHandle
WriteFile
ReadFile
FindResourceExW
LockResource
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetThreadLocale
SetThreadLocale
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
InterlockedExchange
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
LCMapStringA
GetStdHandle
SuspendThread
OpenThread
LoadLibraryA
lstrcpyW
Thread32First
Thread32Next
CreateToolhelp32Snapshot
ExitProcess
HeapCreate
VirtualAlloc
VirtualFree
GetCurrentProcessId
LCMapStringW
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetSystemTimeAsFileTime
GetCommandLineA
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
SetEndOfFile
GetVolumeNameForVolumeMountPointA
QueryDosDeviceA
GetVolumePathNamesForVolumeNameA
GetSystemDefaultLangID
DeviceIoControl
FileTimeToLocalFileTime
LocalAlloc
LocalFree
OpenMutexA
SetLastError
CreateMutexA
GetWindowsDirectoryA
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
MultiByteToWideChar
Sleep

user32

CharNextW

advapi32

RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExA
RegOpenKeyExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoCreateInstance

shell32

SHGetFolderPathA

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
SysStringLen

shlwapi

PathFileExistsA
PathFindExtensionW
PathFindFileNameA
PathFindExtensionA
PathFindFileNameW

hid

HidD_FlushQueue
HidD_GetHidGuid
HidD_GetAttributes
HidD_GetProductString
HidD_FreePreparsedData
HidD_GetFeature
HidD_SetFeature
HidD_GetPreparsedData
HidP_GetCaps

psapi

GetModuleFileNameExW
GetModuleFileNameExA

iphlpapi

GetAdaptersInfo

netapi32

Netbios

ws2_32

gethostbyname
WSAStartup
gethostname
inet_ntoa

winhttp

WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpWriteData
WinHttpOpenRequest
WinHttpConnect

setupapi

CM_Get_Sibling
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
CM_Locate_DevNodeA
CM_Get_Parent
CM_Get_Child
CM_Get_DevNode_Registry_PropertyA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
CM_Get_Device_IDA

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertGetNameStringA
CryptDecodeObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 529KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33db6a2e0c8b0b1712938324307d0d1c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

hid

psapi

iphlpapi

netapi32

ws2_32

winhttp

setupapi

crypt32

Exports

Exports

Sections

.text Size: 529KB - Virtual size: 528KB

.rdata Size: 69KB - Virtual size: 69KB

.data Size: 8KB - Virtual size: 52KB

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 529KB - Virtual size: 528KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 8KB - Virtual size: 52KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 32KB - Virtual size: 31KB