116f92928470f2418cc2b050f46535f188781f2625394867153e2d7f81fc66a1

Sharing

Copy URL Twitter E-mail

General

Target

116f92928470f2418cc2b050f46535f188781f2625394867153e2d7f81fc66a1
Size

409KB
MD5

7c9750fe8873e339f7cdedc006a01cbb
SHA1

183c2fbcd9e0c441d54cff549a5a3cc4679dc5ae
SHA256

116f92928470f2418cc2b050f46535f188781f2625394867153e2d7f81fc66a1
SHA512

14ec744ac0cddb267a319aba158ae34344fdeb4a67090bf29ceed813f7199e0e945826f065544f6afbfca852eca78a6977a04dcd50b3931d3ffe38b2a876a306
SSDEEP

12288:AW32+MxBEiCG2yf+u0fp2IPWJZXRL26m1/eb:ADCG2yfWrPQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
116f92928470f2418cc2b050f46535f188781f2625394867153e2d7f81fc66a1

Files

116f92928470f2418cc2b050f46535f188781f2625394867153e2d7f81fc66a1
.dll windows x86

227085ed699f2cff9cafa43ce512706a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

_amsg_exit
_initterm
_iob
_lock
_unlock
abort
calloc
free
fwrite
memcpy
memmove
memset
memcmp
realloc
strlen
strncmp
vfprintf

libnspr4

PR_CallOnce
PR_Calloc
PR_DestroyLock
PR_Free
PR_GetThreadPrivate
PR_Lock
PR_NewLock
PR_NewThreadPrivateIndex
PR_SetThreadPrivate
PR_Unlock

libplc4

PL_strcasecmp
PL_strlen

libplds4

PL_ArenaAllocate
PL_ArenaRelease
PL_CompareValues
PL_FinishArenaPool
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable

Exports

Exports

C_GetFunctionList
NSSArena_Create
NSSArena_Destroy
NSSCKFWC_CancelFunction
NSSCKFWC_CloseAllSessions
NSSCKFWC_CloseSession
NSSCKFWC_CopyObject
NSSCKFWC_CreateObject
NSSCKFWC_Decrypt
NSSCKFWC_DecryptDigestUpdate
NSSCKFWC_DecryptFinal
NSSCKFWC_DecryptInit
NSSCKFWC_DecryptUpdate
NSSCKFWC_DecryptVerifyUpdate
NSSCKFWC_DeriveKey
NSSCKFWC_DestroyObject
NSSCKFWC_Digest
NSSCKFWC_DigestEncryptUpdate
NSSCKFWC_DigestFinal
NSSCKFWC_DigestInit
NSSCKFWC_DigestKey
NSSCKFWC_DigestUpdate
NSSCKFWC_Encrypt
NSSCKFWC_EncryptFinal
NSSCKFWC_EncryptInit
NSSCKFWC_EncryptUpdate
NSSCKFWC_Finalize
NSSCKFWC_FindObjects
NSSCKFWC_FindObjectsFinal
NSSCKFWC_FindObjectsInit
NSSCKFWC_GenerateKey
NSSCKFWC_GenerateKeyPair
NSSCKFWC_GenerateRandom
NSSCKFWC_GetAttributeValue
NSSCKFWC_GetFunctionStatus
NSSCKFWC_GetInfo
NSSCKFWC_GetMechanismInfo
NSSCKFWC_GetMechanismList
NSSCKFWC_GetObjectSize
NSSCKFWC_GetOperationState
NSSCKFWC_GetSessionInfo
NSSCKFWC_GetSlotInfo
NSSCKFWC_GetSlotList
NSSCKFWC_GetTokenInfo
NSSCKFWC_InitPIN
NSSCKFWC_InitToken
NSSCKFWC_Initialize
NSSCKFWC_Login
NSSCKFWC_Logout
NSSCKFWC_OpenSession
NSSCKFWC_SeedRandom
NSSCKFWC_SetAttributeValue
NSSCKFWC_SetOperationState
NSSCKFWC_SetPIN
NSSCKFWC_Sign
NSSCKFWC_SignEncryptUpdate
NSSCKFWC_SignFinal
NSSCKFWC_SignInit
NSSCKFWC_SignRecover
NSSCKFWC_SignRecoverInit
NSSCKFWC_SignUpdate
NSSCKFWC_UnwrapKey
NSSCKFWC_Verify
NSSCKFWC_VerifyFinal
NSSCKFWC_VerifyInit
NSSCKFWC_VerifyRecover
NSSCKFWC_VerifyRecoverInit
NSSCKFWC_VerifyUpdate
NSSCKFWC_WaitForSlotEvent
NSSCKFWC_WrapKey
NSSCKFWFindObjects_GetMDFindObjects
NSSCKFWInstance_CreateMutex
NSSCKFWInstance_DestroySessionHandle
NSSCKFWInstance_FindSessionHandle
NSSCKFWInstance_GetArena
NSSCKFWInstance_GetConfigurationData
NSSCKFWInstance_GetInitArgs
NSSCKFWInstance_GetMDInstance
NSSCKFWInstance_MayCreatePthreads
NSSCKFWMutex_Destroy
NSSCKFWMutex_Lock
NSSCKFWMutex_Unlock
NSSCKFWObject_GetArena
NSSCKFWObject_GetAttribute
NSSCKFWObject_GetAttributeCount
NSSCKFWObject_GetAttributeSize
NSSCKFWObject_GetAttributeTypes
NSSCKFWObject_GetMDObject
NSSCKFWObject_GetObjectSize
NSSCKFWObject_IsTokenObject
NSSCKFWSession_CallNotification
NSSCKFWSession_GetArena
NSSCKFWSession_GetCurrentCryptoOperation
NSSCKFWSession_GetFWSlot
NSSCKFWSession_GetMDSession
NSSCKFWSession_GetSessionState
NSSCKFWSession_IsRWSession
NSSCKFWSession_IsSO
NSSCKFWSlot_GetFWInstance
NSSCKFWSlot_GetMDInstance
NSSCKFWSlot_GetMDSlot
NSSCKFWSlot_GetSlotID
NSSCKFWToken_GetArena
NSSCKFWToken_GetFWSlot
NSSCKFWToken_GetMDSlot
NSSCKFWToken_GetMDToken
NSS_ERROR_ALREADY_INITIALIZED
NSS_ERROR_ARENA_MARKED_BY_ANOTHER_THREAD
NSS_ERROR_BUFFER_TOO_SHORT
NSS_ERROR_BUSY
NSS_ERROR_CERTIFICATE_IN_CACHE
NSS_ERROR_CERTIFICATE_ISSUER_NOT_FOUND
NSS_ERROR_DEVICE_ERROR
NSS_ERROR_DUPLICATE_POINTER
NSS_ERROR_HASH_COLLISION
NSS_ERROR_INTERNAL_ERROR
NSS_ERROR_INVALID_ARENA
NSS_ERROR_INVALID_ARENA_MARK
NSS_ERROR_INVALID_ARGUMENT
NSS_ERROR_INVALID_ASN1DECODER
NSS_ERROR_INVALID_ASN1ENCODER
NSS_ERROR_INVALID_ATAV
NSS_ERROR_INVALID_ATOB_CONTEXT
NSS_ERROR_INVALID_BASE64
NSS_ERROR_INVALID_BER
NSS_ERROR_INVALID_BTOA_CONTEXT
NSS_ERROR_INVALID_CERTIFICATE
NSS_ERROR_INVALID_ITEM
NSS_ERROR_INVALID_NSSOID
NSS_ERROR_INVALID_PASSWORD
NSS_ERROR_INVALID_POINTER
NSS_ERROR_INVALID_STRING
NSS_ERROR_INVALID_UTF8
NSS_ERROR_MAXIMUM_FOUND
NSS_ERROR_NOT_FOUND
NSS_ERROR_NO_ERROR
NSS_ERROR_NO_MEMORY
NSS_ERROR_PKCS11
NSS_ERROR_POINTER_NOT_REGISTERED
NSS_ERROR_TRACKER_NOT_EMPTY
NSS_ERROR_TRACKER_NOT_INITIALIZED
NSS_ERROR_UNKNOWN_ATTRIBUTE
NSS_ERROR_UNSUPPORTED_TYPE
NSS_ERROR_USER_CANCELED
NSS_ERROR_VALUE_TOO_LARGE
NSS_GetError
NSS_GetErrorStack
NSS_ZAlloc
NSS_ZFreeIf
NSS_ZRealloc
__nss_builtins_version
nssArenaHashAllocOps
nssArena_Create
nssArena_Destroy
nssArena_Mark
nssArena_Release
nssArena_Shutdown
nssArena_Unmark
nssCKFWCryptoOperation_Create
nssCKFWCryptoOperation_Destroy
nssCKFWCryptoOperation_DigestKey
nssCKFWCryptoOperation_DigestUpdate
nssCKFWCryptoOperation_Final
nssCKFWCryptoOperation_GetFinalLength
nssCKFWCryptoOperation_GetMDCryptoOperation
nssCKFWCryptoOperation_GetOperationLength
nssCKFWCryptoOperation_GetType
nssCKFWCryptoOperation_Update
nssCKFWCryptoOperation_UpdateCombo
nssCKFWCryptoOperation_UpdateFinal
nssCKFWFindObjects_Create
nssCKFWFindObjects_Destroy
nssCKFWFindObjects_GetMDFindObjects
nssCKFWFindObjects_Next
nssCKFWHash_Add
nssCKFWHash_Count
nssCKFWHash_Create
nssCKFWHash_Destroy
nssCKFWHash_Exists
nssCKFWHash_Iterate
nssCKFWHash_Lookup
nssCKFWHash_Remove
nssCKFWInstance_Create
nssCKFWInstance_CreateMutex
nssCKFWInstance_CreateObjectHandle
nssCKFWInstance_CreateSessionHandle
nssCKFWInstance_Destroy
nssCKFWInstance_DestroyObjectHandle
nssCKFWInstance_DestroySessionHandle
nssCKFWInstance_FindObjectHandle
nssCKFWInstance_FindSessionHandle
nssCKFWInstance_GetArena
nssCKFWInstance_GetConfigurationData
nssCKFWInstance_GetCryptokiVersion
nssCKFWInstance_GetFlags
nssCKFWInstance_GetInitArgs
nssCKFWInstance_GetLibraryDescription
nssCKFWInstance_GetLibraryVersion
nssCKFWInstance_GetMDInstance
nssCKFWInstance_GetManufacturerID
nssCKFWInstance_GetModuleHandlesSessionObjects
nssCKFWInstance_GetNSlots
nssCKFWInstance_GetSlots
nssCKFWInstance_MayCreatePthreads
nssCKFWInstance_ReassignObjectHandle
nssCKFWInstance_ResolveObjectHandle
nssCKFWInstance_ResolveSessionHandle
nssCKFWInstance_WaitForSlotEvent
nssCKFWMechanism_Create
nssCKFWMechanism_DecryptInit
nssCKFWMechanism_DeriveKey
nssCKFWMechanism_Destroy
nssCKFWMechanism_DigestInit
nssCKFWMechanism_EncryptInit
nssCKFWMechanism_GenerateKey
nssCKFWMechanism_GenerateKeyPair
nssCKFWMechanism_GetCanDecrypt
nssCKFWMechanism_GetCanDerive
nssCKFWMechanism_GetCanDigest
nssCKFWMechanism_GetCanEncrypt
nssCKFWMechanism_GetCanGenerate
nssCKFWMechanism_GetCanGenerateKeyPair
nssCKFWMechanism_GetCanSign
nssCKFWMechanism_GetCanSignRecover
nssCKFWMechanism_GetCanUnwrap
nssCKFWMechanism_GetCanVerify
nssCKFWMechanism_GetCanVerifyRecover
nssCKFWMechanism_GetCanWrap
nssCKFWMechanism_GetInHardware
nssCKFWMechanism_GetMDMechanism
nssCKFWMechanism_GetMaxKeySize
nssCKFWMechanism_GetMinKeySize
nssCKFWMechanism_GetWrapKeyLength
nssCKFWMechanism_SignInit
nssCKFWMechanism_SignRecoverInit
nssCKFWMechanism_UnwrapKey
nssCKFWMechanism_VerifyInit
nssCKFWMechanism_VerifyRecoverInit
nssCKFWMechanism_WrapKey
nssCKFWMutex_Create
nssCKFWMutex_Destroy
nssCKFWMutex_Lock
nssCKFWMutex_Unlock
nssCKFWObject_Create
nssCKFWObject_Destroy
nssCKFWObject_Finalize
nssCKFWObject_GetArena
nssCKFWObject_GetAttribute
nssCKFWObject_GetAttributeCount
nssCKFWObject_GetAttributeSize
nssCKFWObject_GetAttributeTypes
nssCKFWObject_GetHandle
nssCKFWObject_GetMDObject
nssCKFWObject_GetObjectSize
nssCKFWObject_IsTokenObject
nssCKFWObject_SetAttribute
nssCKFWObject_SetHandle
nssCKFWSession_CallNotification
nssCKFWSession_CopyObject
nssCKFWSession_Create
nssCKFWSession_CreateObject
nssCKFWSession_DeregisterSessionObject
nssCKFWSession_Destroy
nssCKFWSession_DigestKey
nssCKFWSession_DigestUpdate
nssCKFWSession_Final
nssCKFWSession_FindObjectsInit
nssCKFWSession_GetArena
nssCKFWSession_GetCurrentCryptoOperation
nssCKFWSession_GetDeviceError
nssCKFWSession_GetFWFindObjects
nssCKFWSession_GetFWSlot
nssCKFWSession_GetHandle
nssCKFWSession_GetMDSession
nssCKFWSession_GetOperationState
nssCKFWSession_GetOperationStateLen
nssCKFWSession_GetRandom
nssCKFWSession_GetSessionState
nssCKFWSession_InitPIN
nssCKFWSession_IsRWSession
nssCKFWSession_IsSO
nssCKFWSession_Login
nssCKFWSession_Logout
nssCKFWSession_RegisterSessionObject
nssCKFWSession_SeedRandom
nssCKFWSession_SetCurrentCryptoOperation
nssCKFWSession_SetFWFindObjects
nssCKFWSession_SetHandle
nssCKFWSession_SetMDSession
nssCKFWSession_SetOperationState
nssCKFWSession_SetPIN
nssCKFWSession_Update
nssCKFWSession_UpdateCombo
nssCKFWSession_UpdateFinal
nssCKFWSlot_ClearToken
nssCKFWSlot_Create
nssCKFWSlot_Destroy
nssCKFWSlot_GetFWInstance
nssCKFWSlot_GetFirmwareVersion
nssCKFWSlot_GetHardwareSlot
nssCKFWSlot_GetHardwareVersion
nssCKFWSlot_GetMDInstance
nssCKFWSlot_GetMDSlot
nssCKFWSlot_GetManufacturerID
nssCKFWSlot_GetRemovableDevice
nssCKFWSlot_GetSlotDescription
nssCKFWSlot_GetSlotID
nssCKFWSlot_GetToken
nssCKFWSlot_GetTokenPresent
nssCKFWToken_CloseAllSessions
nssCKFWToken_Create
nssCKFWToken_Destroy
nssCKFWToken_GetArena
nssCKFWToken_GetFWSlot
nssCKFWToken_GetFirmwareVersion
nssCKFWToken_GetFreePrivateMemory
nssCKFWToken_GetFreePublicMemory
nssCKFWToken_GetHardwareVersion
nssCKFWToken_GetHasClockOnToken
nssCKFWToken_GetHasProtectedAuthenticationPath
nssCKFWToken_GetHasRNG
nssCKFWToken_GetIsWriteProtected
nssCKFWToken_GetLabel
nssCKFWToken_GetLoginRequired
nssCKFWToken_GetMDObjectHash
nssCKFWToken_GetMDSlot
nssCKFWToken_GetMDToken
nssCKFWToken_GetManufacturerID
nssCKFWToken_GetMaxPinLen
nssCKFWToken_GetMaxRwSessionCount
nssCKFWToken_GetMaxSessionCount
nssCKFWToken_GetMechanism
nssCKFWToken_GetMechanismCount
nssCKFWToken_GetMechanismTypes
nssCKFWToken_GetMinPinLen
nssCKFWToken_GetModel
nssCKFWToken_GetObjectHandleHash
nssCKFWToken_GetRestoreKeyNotNeeded
nssCKFWToken_GetRoSessionCount
nssCKFWToken_GetRwSessionCount
nssCKFWToken_GetSerialNumber
nssCKFWToken_GetSessionCount
nssCKFWToken_GetSessionObjectHash
nssCKFWToken_GetSessionState
nssCKFWToken_GetSupportsDualCryptoOperations
nssCKFWToken_GetTotalPrivateMemory
nssCKFWToken_GetTotalPublicMemory
nssCKFWToken_GetUTCTime
nssCKFWToken_GetUserPinInitialized
nssCKFWToken_InitToken
nssCKFWToken_OpenSession
nssCKFWToken_RemoveSession
nssCKFWToken_SetSessionState
nssCKMDFindSessionObjects_Create
nssCKMDSessionObject_Create
nssItem_Create
nssItem_Destroy
nssItem_Duplicate
nssItem_Equal
nssUTF8_CaseIgnoreMatch
nssUTF8_CopyIntoFixedBuffer
nssUTF8_Create
nssUTF8_Duplicate
nssUTF8_Equal
nssUTF8_GetEncoding
nssUTF8_Length
nssUTF8_PrintableMatch
nssUTF8_Size
nss_ClearErrorStack
nss_DestroyErrorStack
nss_SetError
nss_ZAlloc
nss_ZFreeIf
nss_ZRealloc
nss_builtins_CreateMDObject
nss_builtins_CreateSession
nss_builtins_CryptokiVersion
nss_builtins_FindObjectsInit
nss_builtins_FirmwareVersion
nss_builtins_HardwareVersion
nss_builtins_LibraryDescription
nss_builtins_LibraryVersion
nss_builtins_ManufacturerID
nss_builtins_SlotDescription
nss_builtins_TokenLabel
nss_builtins_TokenModel
nss_builtins_TokenSerialNumber
nss_builtins_data
nss_builtins_mdInstance
nss_builtins_mdSlot
nss_builtins_mdToken
nss_builtins_nObjects
nsslibc_memcmp
nsslibc_memcpy
nsslibc_memequal
nsslibc_memset

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 160B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

227085ed699f2cff9cafa43ce512706a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

libnspr4

libplc4

libplds4

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 66KB

.data Size: 19KB - Virtual size: 19KB

.rdata Size: 267KB - Virtual size: 267KB

/4 Size: 21KB - Virtual size: 21KB

.bss Size: - Virtual size: 160B

.edata Size: 14KB - Virtual size: 13KB

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 768B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 66KB - Virtual size: 66KB

.data
Size: 19KB - Virtual size: 19KB

.rdata
Size: 267KB - Virtual size: 267KB

/4
Size: 21KB - Virtual size: 21KB

.bss
Size: - Virtual size: 160B

.edata
Size: 14KB - Virtual size: 13KB

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 768B

.reloc
Size: 13KB - Virtual size: 12KB