e553557ce4ff74c0a86d036e52486d638c05caa3d7ac4ce8fbd6543b265f0cf5

Sharing

Copy URL Twitter E-mail

General

Target

e553557ce4ff74c0a86d036e52486d638c05caa3d7ac4ce8fbd6543b265f0cf5
Size

1.5MB
MD5

1b11d4629214cdf110e94b6412996969
SHA1

17d00d5202e29c96ce7ddebc3de445edfbad4916
SHA256

e553557ce4ff74c0a86d036e52486d638c05caa3d7ac4ce8fbd6543b265f0cf5
SHA512

e9eb70188915fbc21621b81cc525b0bd45983987aeefceeb201ccb86351caa86562d49ed4d81adf38ce6aa7898102af6d369a12cd46b7fa8b2abeeacbaf98fa3
SSDEEP

24576:j4GtYU7IsTjpuz1Cabwn18in+l7Vmx80JtTrEIGKZCwjz4ymcKVu8+uAS5+qbioa:jTBIsT+M6inkmxBzUG3bqbioUp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e553557ce4ff74c0a86d036e52486d638c05caa3d7ac4ce8fbd6543b265f0cf5

Files

e553557ce4ff74c0a86d036e52486d638c05caa3d7ac4ce8fbd6543b265f0cf5
.dll windows x86

a34c5a20d71d9a9a0afe48a48333d749

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
CreateMutexA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
CreateSemaphoreA
ReleaseSemaphore
CreateFileMappingA
MapViewOfFileEx
CreateFileA
GetFileSizeEx
FormatMessageA
LocalFree
CreateDirectoryA
RemoveDirectoryA
SetEndOfFile
SetFilePointerEx
WriteFile
GetProcAddress
OpenProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
LoadLibraryA
AreFileApisANSI
GetExitCodeProcess
CreateProcessA
FreeLibrary
GetStdHandle
GetConsoleMode
VerSetConditionMask
IsWow64Process
GetProfileStringA
VerifyVersionInfoW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
SetFileTime
FlushFileBuffers
GetFileTime
ReadFile
SetFilePointer
ExitProcess
SwitchToThread
TlsSetValue
LocalAlloc
MapViewOfFile
OpenFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
TlsAlloc
CreateEventA
WaitForMultipleObjects
IsBadWritePtr
OpenSemaphoreA
GetVersion
FlushInstructionCache
VirtualProtect
DeviceIoControl
LockFile
UnlockFile
IsBadStringPtrA
IsBadStringPtrW
GetDriveTypeA
ReadConsoleW
CreateFileW
WriteConsoleW
SetStdHandle
OutputDebugStringW
GetConsoleCP
SetEnvironmentVariableA
GetModuleFileNameW
GetOEMCP
IsValidCodePage
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
LoadLibraryExW
GetCPInfo
HeapReAlloc
GetModuleHandleExW
GetFileType
RtlUnwind
RaiseException
GetStringTypeW
Sleep
GetProcessTimes
IsBadReadPtr
GetComputerNameA
GetNativeSystemInfo
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
SetLastError
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetVersionExA
SetPriorityClass
TlsFree
SetThreadPriority
GetCurrentThread
TerminateProcess
HeapFree
GetCurrentDirectoryA
SetConsoleCtrlHandler
OpenEventA
SetEvent
GetACP
SystemTimeToFileTime
GetTempPathA
GetLocalTime
GetDiskFreeSpaceA
GetUserDefaultUILanguage
GetExitCodeThread
GetCurrentThreadId
DuplicateHandle
GetTickCount
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapAlloc
DecodePointer
EncodePointer
TlsGetValue
HeapCreate

user32

GetSystemMenu
AppendMenuA
LoadStringA
DrawMenuBar
TranslateMessage
DispatchMessageA
GetSystemMetrics
MessageBoxA
CharLowerBuffA
CharUpperBuffA
wsprintfA
CallMsgFilterA
PeekMessageA

shell32

ShellExecuteExA

advapi32

StartServiceA
QueryServiceStatus
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegFlushKey
RegDeleteKeyA
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
GetUserNameA
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ReadEventLogA
CloseEventLog
OpenEventLogA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

inet_addr
bind
getpeername
WSAGetLastError
socket
shutdown
setsockopt
send
select
recvfrom
getsockopt
ioctlsocket
connect
closesocket
accept
__WSAFDIsSet
gethostbyaddr
inet_ntoa
htons
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
gethostname
sendto
gethostbyname
recv

Exports

Exports

??0CZVM@@QAE@ABV0@@Z
??0CZVM@@QAE@XZ
??0TCPoint@@QAE@ABV0@@Z
??1CZVM@@UAE@XZ
??1T3DBox@@QAE@XZ
??1TCRect@@QAE@XZ
??1TCSize@@QAE@XZ
??4CReUndoUnit@@QAEAAV0@ABV0@@Z
??4CZVM@@QAEAAV0@ABV0@@Z
??4TCLine@@QAEAAV0@ABV0@@Z
??4TCPoint@@QAEAAV0@ABV0@@Z
??4TCRect@@QAEAAV0@ABV0@@Z
??4TCSize@@QAEAAV0@ABV0@@Z
??_7CZVM@@6B@
??_7TCPoint@@6B@
?DPtoLP@CZVM@@UBEXPAUtagRECT@@@Z
?DPtoLP@CZVM@@UBEXPAUtagSIZE@@@Z
?ID@CLayer@@QAEHXZ
?ParaID@CLayer@@QAEHXZ
GetCmdInfo

Sections

__wibu00
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu03
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu04
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu05
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

__wibu06
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu07
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu08
Size: 49KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu09
Size: 80KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a34c5a20d71d9a9a0afe48a48333d749

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

advapi32

version

ws2_32

Exports

Exports

Sections

__wibu00 Size: 56KB - Virtual size: 56KB

__wibu01 Size: 28KB - Virtual size: 28KB

__wibu02 Size: 3KB - Virtual size: 4KB

__wibu03 Size: 512B - Virtual size: 68B

__wibu04 Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

__wibu05 Size: 6KB - Virtual size: 6KB

__wibu06 Size: 1.3MB - Virtual size: 1.3MB

__wibu07 Size: 6KB - Virtual size: 8KB

__wibu08 Size: 49KB - Virtual size: 68KB

__wibu09 Size: 80KB - Virtual size: 84KB

__wibu00
Size: 56KB - Virtual size: 56KB

__wibu01
Size: 28KB - Virtual size: 28KB

__wibu02
Size: 3KB - Virtual size: 4KB

__wibu03
Size: 512B - Virtual size: 68B

__wibu04
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

__wibu05
Size: 6KB - Virtual size: 6KB

__wibu06
Size: 1.3MB - Virtual size: 1.3MB

__wibu07
Size: 6KB - Virtual size: 8KB

__wibu08
Size: 49KB - Virtual size: 68KB

__wibu09
Size: 80KB - Virtual size: 84KB