74c030fa85f7e770800ee2041aff6ccf9bd97e59fa0dc1dd0c10fb423e846331

Sharing

Copy URL Twitter E-mail

General

Target

74c030fa85f7e770800ee2041aff6ccf9bd97e59fa0dc1dd0c10fb423e846331
Size

383KB
MD5

abc5c888a8e91c8885404089283c05db
SHA1

b776d01b7562eccbe41b0f982df575c660cc0b1c
SHA256

74c030fa85f7e770800ee2041aff6ccf9bd97e59fa0dc1dd0c10fb423e846331
SHA512

13e46f9bb122401da26fae46fbcaa253aa61a5766e48f26ae46e3563c646ccd0c8d591de969ed28cf4238a6eae49ee48a590e2b799d659c4561bbaa0f74a7491
SSDEEP

6144:hXFg9szyuXpfP/1IltLdcpPeVVupk9tqOQTyrktAJ3MpZbUXX:hXFg9szyUfP2l1dIQYpFE3MpZbUXX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74c030fa85f7e770800ee2041aff6ccf9bd97e59fa0dc1dd0c10fb423e846331

Files

74c030fa85f7e770800ee2041aff6ccf9bd97e59fa0dc1dd0c10fb423e846331
.dll windows x86

ce4bc2d50fa551206a65fdcd7520e6cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

nssutil3

DER_Encode_Util
DER_GetInteger_Util
DER_SetUInteger
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgFetchValue
NSSUTIL_ArgGetLabel
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_DoModuleDBFunction
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_SecureMemcmp
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_Realloc_Util
PORT_SetError_Util
PORT_Strdup_Util
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_DupItem_Util
SECITEM_FreeItem_Util
SECITEM_HashCompare
SECITEM_ItemsAreEqual_Util
SECITEM_ZfreeItem_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_FindOIDByMechanism
SECOID_GetAlgorithmTag_Util
SECOID_Init
SECOID_SetAlgorithmID_Util
SECOID_Shutdown
SEC_ASN1DecodeItem_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_QuickDERDecodeItem_Util
SGN_CreateDigestInfo_Util
SGN_DestroyDigestInfo_Util
UTIL_SetForkState
_NSSUTIL_Access
_NSSUTIL_EvaluateConfigDir
_NSSUTIL_UTF8ToWide
_SGN_VerifyPKCS1DigestInfo

libgcc_s_dw2-1

__divdi3
__udivdi3

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetTempPathA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__mb_cur_max
_amsg_exit
_errno
_initterm
_iob
_lock
_unlock
_wchmod
abort
atoi
calloc
fputc
free
fwrite
getenv
islower
isupper
localeconv
malloc
memcpy
memmove
memset
memcmp
qsort
realloc
setlocale
strchr
strcmp
strcpy
strerror
strlen
strncmp
strrchr
strtoul
vfprintf
wcslen

libnspr4

PR_Access
PR_CallOnce
PR_DestroyLock
PR_DestroyMonitor
PR_EnterMonitor
PR_ExitMonitor
PR_FindFunctionSymbol
PR_Free
PR_GetCurrentThread
PR_GetDirectorySeparator
PR_GetEnv
PR_GetEnvSecure
PR_GetLibraryFilePathname
PR_IntervalNow
PR_LoadLibraryWithFlags
PR_Lock
PR_MillisecondsToInterval
PR_NewLock
PR_NewMonitor
PR_Now
PR_SecondsToInterval
PR_Sleep
PR_UnloadLibrary
PR_Unlock
PR_smprintf
PR_smprintf_free
PR_snprintf

libplc4

PL_strcasecmp
PL_strncasecmp

libplds4

PL_CompareValues
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRemove
PL_NewHashTable

libsqlite3-0

sqlite3_bind_blob
sqlite3_bind_int
sqlite3_bind_text
sqlite3_busy_timeout
sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_int
sqlite3_column_text
sqlite3_exec
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_mprintf
sqlite3_open_v2
sqlite3_prepare_v2
sqlite3_reset
sqlite3_step

Exports

Exports

AESKeyWrap_AllocateContext
AESKeyWrap_CreateContext
AESKeyWrap_Decrypt
AESKeyWrap_DecryptKWP
AESKeyWrap_DestroyContext
AESKeyWrap_Encrypt
AESKeyWrap_EncryptKWP
AESKeyWrap_InitContext
AES_AEAD
AES_AllocateContext
AES_CreateContext
AES_Decrypt
AES_DestroyContext
AES_Encrypt
AES_InitContext
AddToList
BLAKE2B_Begin
BLAKE2B_DestroyContext
BLAKE2B_End
BLAKE2B_Flatten
BLAKE2B_FlattenSize
BLAKE2B_Hash
BLAKE2B_HashBuf
BLAKE2B_MAC_Begin
BLAKE2B_MAC_HashBuf
BLAKE2B_NewContext
BLAKE2B_Resurrect
BLAKE2B_Update
BLAPI_SHVerify
BLAPI_SHVerifyFile
BLAPI_VerifySelf
BL_Cleanup
BL_Init
BL_SetForkState
BL_Unload
CBC_PadBuffer
CMAC_Begin
CMAC_Create
CMAC_Destroy
CMAC_Finish
CMAC_Init
CMAC_Update
C_GetFunctionList
C_GetInterface
C_GetInterfaceList
Camellia_AllocateContext
Camellia_CreateContext
Camellia_Decrypt
Camellia_DestroyContext
Camellia_Encrypt
Camellia_InitContext
ChaCha20Poly1305_CreateContext
ChaCha20Poly1305_Decrypt
ChaCha20Poly1305_DestroyContext
ChaCha20Poly1305_Encrypt
ChaCha20Poly1305_InitContext
ChaCha20Poly1305_Open
ChaCha20Poly1305_Seal
ChaCha20_CreateContext
ChaCha20_DestroyContext
ChaCha20_InitContext
ChaCha20_Xor
DES_AllocateContext
DES_CreateContext
DES_Decrypt
DES_DestroyContext
DES_Encrypt
DES_InitContext
DH_Derive
DH_GenParam
DH_NewKey
DSA_NewKey
DSA_NewKeyFromSeed
DSA_NewRandom
DSA_SignDigest
DSA_SignDigestWithSeed
DSA_VerifyDigest
ECDH_Derive
ECDSA_SignDigest
ECDSA_SignDigestWithSeed
ECDSA_VerifyDigest
EC_CopyParams
EC_DecodeParams
EC_FillParams
EC_GetPointSize
EC_NewKey
EC_NewKeyFromSeed
EC_ValidatePublicKey
FC_CancelFunction
FC_CloseAllSessions
FC_CloseSession
FC_CopyObject
FC_CreateObject
FC_Decrypt
FC_DecryptDigestUpdate
FC_DecryptFinal
FC_DecryptInit
FC_DecryptMessage
FC_DecryptMessageBegin
FC_DecryptMessageNext
FC_DecryptUpdate
FC_DecryptVerifyUpdate
FC_DeriveKey
FC_DestroyObject
FC_Digest
FC_DigestEncryptUpdate
FC_DigestFinal
FC_DigestInit
FC_DigestKey
FC_DigestUpdate
FC_Encrypt
FC_EncryptFinal
FC_EncryptInit
FC_EncryptMessage
FC_EncryptMessageBegin
FC_EncryptMessageNext
FC_EncryptUpdate
FC_Finalize
FC_FindObjects
FC_FindObjectsFinal
FC_FindObjectsInit
FC_GenerateKey
FC_GenerateKeyPair
FC_GenerateRandom
FC_GetAttributeValue
FC_GetFunctionList
FC_GetFunctionStatus
FC_GetInfo
FC_GetInfoV2
FC_GetInterface
FC_GetInterfaceList
FC_GetMechanismInfo
FC_GetMechanismInfoV2
FC_GetMechanismList
FC_GetObjectSize
FC_GetOperationState
FC_GetSessionInfo
FC_GetSlotInfo
FC_GetSlotList
FC_GetTokenInfo
FC_InitPIN
FC_InitToken
FC_Initialize
FC_Login
FC_LoginUser
FC_Logout
FC_MessageDecryptFinal
FC_MessageDecryptInit
FC_MessageEncryptFinal
FC_MessageEncryptInit
FC_MessageSignFinal
FC_MessageSignInit
FC_MessageVerifyFinal
FC_MessageVerifyInit
FC_OpenSession
FC_SeedRandom
FC_SessionCancel
FC_SetAttributeValue
FC_SetOperationState
FC_SetPIN
FC_Sign
FC_SignEncryptUpdate
FC_SignFinal
FC_SignInit
FC_SignMessage
FC_SignMessageBegin
FC_SignMessageNext
FC_SignRecover
FC_SignRecoverInit
FC_SignUpdate
FC_UnwrapKey
FC_Verify
FC_VerifyFinal
FC_VerifyInit
FC_VerifyMessage
FC_VerifyMessageBegin
FC_VerifyMessageNext
FC_VerifyRecover
FC_VerifyRecoverInit
FC_VerifyUpdate
FC_WaitForSlotEvent
FC_WrapKey
FIPS186Change_GenerateX
FIPS186Change_ReduceModQForDSA
HASH_FromHMACOid
HASH_GetRawHashObject
HASH_HMACOidFromHash
HMAC_Begin
HMAC_Clone
HMAC_ConstantTime
HMAC_Create
HMAC_Destroy
HMAC_Finish
HMAC_Init
HMAC_Update
JPAKE_Final
JPAKE_Round2
JPAKE_Sign
JPAKE_Verify
KEA_Derive
KEA_PrimeCheck
KEA_Verify
MD2_Begin
MD2_Clone
MD2_DestroyContext
MD2_End
MD2_Flatten
MD2_FlattenSize
MD2_Hash
MD2_NewContext
MD2_Resurrect
MD2_Update
MD5_Begin
MD5_Clone
MD5_DestroyContext
MD5_End
MD5_Flatten
MD5_FlattenSize
MD5_Hash
MD5_HashBuf
MD5_NewContext
MD5_Resurrect
MD5_TraceState
MD5_Update
NSC_CancelFunction
NSC_CloseAllSessions
NSC_CloseSession
NSC_CopyObject
NSC_CreateObject
NSC_Decrypt
NSC_DecryptDigestUpdate
NSC_DecryptFinal
NSC_DecryptInit
NSC_DecryptMessage
NSC_DecryptMessageBegin
NSC_DecryptMessageNext
NSC_DecryptUpdate
NSC_DecryptVerifyUpdate
NSC_DeriveKey
NSC_DestroyObject
NSC_Digest
NSC_DigestEncryptUpdate
NSC_DigestFinal
NSC_DigestInit
NSC_DigestKey
NSC_DigestUpdate
NSC_Encrypt
NSC_EncryptFinal
NSC_EncryptInit
NSC_EncryptMessage
NSC_EncryptMessageBegin
NSC_EncryptMessageNext
NSC_EncryptUpdate
NSC_Finalize
NSC_FindObjects
NSC_FindObjectsFinal
NSC_FindObjectsInit
NSC_GenerateKey
NSC_GenerateKeyPair
NSC_GenerateRandom
NSC_GetAttributeValue
NSC_GetFunctionList
NSC_GetFunctionStatus
NSC_GetInfo
NSC_GetInfoV2
NSC_GetInterface
NSC_GetInterfaceList
NSC_GetMechanismInfo
NSC_GetMechanismInfoV2
NSC_GetMechanismList
NSC_GetObjectSize
NSC_GetOperationState
NSC_GetSessionInfo
NSC_GetSlotInfo
NSC_GetSlotList
NSC_GetTokenInfo
NSC_InitPIN
NSC_InitToken
NSC_Initialize
NSC_Login
NSC_LoginUser
NSC_Logout
NSC_MessageDecryptFinal
NSC_MessageDecryptInit
NSC_MessageEncryptFinal
NSC_MessageEncryptInit
NSC_MessageSignFinal
NSC_MessageSignInit
NSC_MessageVerifyFinal
NSC_MessageVerifyInit
NSC_ModuleDBFunc
NSC_OpenSession
NSC_SeedRandom
NSC_SessionCancel
NSC_SetAttributeValue
NSC_SetOperationState
NSC_SetPIN
NSC_Sign
NSC_SignEncryptUpdate
NSC_SignFinal
NSC_SignInit
NSC_SignMessage
NSC_SignMessageBegin
NSC_SignMessageNext
NSC_SignRecover
NSC_SignRecoverInit
NSC_SignUpdate
NSC_UnwrapKey
NSC_Verify
NSC_VerifyFinal
NSC_VerifyInit
NSC_VerifyMessage
NSC_VerifyMessageBegin
NSC_VerifyMessageNext
NSC_VerifyRecover
NSC_VerifyRecoverInit
NSC_VerifyUpdate
NSC_WaitForSlotEvent
NSC_WrapKey
PQG_DestroyParams
PQG_DestroyVerify
PQG_ParamGen
PQG_ParamGenSeedLen
PQG_ParamGenV2
PQG_VerifyParams
PRNGTEST_Generate
PRNGTEST_Instantiate
PRNGTEST_Reseed
PRNGTEST_RunHealthTests
PRNGTEST_Uninstantiate
RC2_AllocateContext
RC2_CreateContext
RC2_Decrypt
RC2_DestroyContext
RC2_Encrypt
RC2_InitContext
RC4_AllocateContext
RC4_CreateContext
RC4_Decrypt
RC4_DestroyContext
RC4_Encrypt
RC4_InitContext
RC5_CreateContext
RC5_Decrypt
RC5_DestroyContext
RC5_Encrypt
RNG_GenerateGlobalRandomBytes
RNG_RNGInit
RNG_RNGShutdown
RNG_RandomUpdate
RNG_SystemInfoForRNG
RSA_CheckSign
RSA_CheckSignPSS
RSA_CheckSignRaw
RSA_CheckSignRecover
RSA_CheckSignRecoverRaw
RSA_DecryptBlock
RSA_DecryptOAEP
RSA_DecryptRaw
RSA_EncryptBlock
RSA_EncryptOAEP
RSA_EncryptRaw
RSA_HashCheckSign
RSA_HashSign
RSA_NewKey
RSA_PopulatePrivateKey
RSA_PrivateKeyCheck
RSA_PrivateKeyOp
RSA_PrivateKeyOpDoubleChecked
RSA_PublicKeyOp
RSA_Sign
RSA_SignPSS
RSA_SignRaw
SEED_CreateContext
SEED_Decrypt
SEED_DestroyContext
SEED_Encrypt
SEED_InitContext
SFTK_ClearTokenKeyHashTable
SFTK_DestroySlotData
SFTK_ShutdownSlot
SFTK_SlotInit
SFTK_SlotReInit
SHA1_Begin
SHA1_Clone
SHA1_DestroyContext
SHA1_End
SHA1_Flatten
SHA1_FlattenSize
SHA1_Hash
SHA1_HashBuf
SHA1_NewContext
SHA1_Resurrect
SHA1_TraceState
SHA1_Update
SHA224_Begin
SHA224_Clone
SHA224_DestroyContext
SHA224_End
SHA224_Flatten
SHA224_FlattenSize
SHA224_Hash
SHA224_HashBuf
SHA224_NewContext
SHA224_Resurrect
SHA224_TraceState
SHA224_Update
SHA256_Begin
SHA256_Clone
SHA256_DestroyContext
SHA256_End
SHA256_Flatten
SHA256_FlattenSize
SHA256_Hash
SHA256_HashBuf
SHA256_NewContext
SHA256_Resurrect
SHA256_TraceState
SHA256_Update
SHA384_Begin
SHA384_Clone
SHA384_DestroyContext
SHA384_End
SHA384_Flatten
SHA384_FlattenSize
SHA384_Hash
SHA384_HashBuf
SHA384_NewContext
SHA384_Resurrect
SHA384_TraceState
SHA384_Update
SHA512_Begin
SHA512_Clone
SHA512_DestroyContext
SHA512_End
SHA512_Flatten
SHA512_FlattenSize
SHA512_Hash
SHA512_HashBuf
SHA512_NewContext
SHA512_Resurrect
SHA512_TraceState
SHA512_Update
SQLITE_EXPLICIT_NULL
SSLv3_MAC_ConstantTime
TLS_PRF
TLS_P_hash
__nss_softokn_version
fc_getAttribute
fc_log_init_error
jpake_Final
jpake_Round1
jpake_Round2
kbkdf_CreateKey
kbkdf_Dispatch
kbkdf_FinalizeKey
kbkdf_GetDerivedKeySize
kbkdf_IncrementBuffer
kbkdf_SaveKey
kbkdf_SaveKeys
nsc_CommonFinalize
nsc_CommonGetSlotList
nsc_CommonInitialize
nsc_SetupHMACKeyGen
nsc_init
nsf_init
nsslowkey_AttributeTemplate
nsslowkey_ConvertToPublicKey
nsslowkey_CopyPrivateKey
nsslowkey_DHPrivateKeyTemplate
nsslowkey_DSAPrivateKeyExportTemplate
nsslowkey_DSAPrivateKeyTemplate
nsslowkey_DestroyPrivateKey
nsslowkey_DestroyPublicKey
nsslowkey_ECPrivateKeyTemplate
nsslowkey_PQGParamsTemplate
nsslowkey_PrivateKeyInfoTemplate
nsslowkey_PrivateModulusLen
nsslowkey_PublicModulusLen
nsslowkey_RSAPrivateKeyTemplate
nsslowkey_RSAPublicKeyTemplate
nsslowkey_SetOfAttributeTemplate
nsslowkey_SubjectPublicKeyInfoTemplate
nsspkcs5_AlgidToParam
nsspkcs5_CipherData
nsspkcs5_ComputeKeyAndIV
nsspkcs5_CreateAlgorithmID
nsspkcs5_DestroyPBEParameter
nsspkcs5_HashBuf
nsspkcs5_NewParam
parentForkedAfterC_Initialize
prepare_low_dh_priv_key_for_asn1
prepare_low_dsa_priv_key_export_for_asn1
prepare_low_dsa_priv_key_for_asn1
prepare_low_ec_priv_key_for_asn1
prepare_low_ecparams_for_asn1
prepare_low_pqg_params_for_asn1
prepare_low_rsa_priv_key_for_asn1
prepare_low_rsa_pub_key_for_asn1
s_open

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce4bc2d50fa551206a65fdcd7520e6cb

Headers

DLL Characteristics

File Characteristics

Imports

nssutil3

libgcc_s_dw2-1

kernel32

msvcrt

libnspr4

libplc4

libplds4

libsqlite3-0

Exports

Exports

Sections

.text Size: 249KB - Virtual size: 248KB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 35KB - Virtual size: 35KB

/4 Size: 50KB - Virtual size: 50KB

.bss Size: - Virtual size: 3KB

.edata Size: 20KB - Virtual size: 19KB

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 249KB - Virtual size: 248KB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 35KB - Virtual size: 35KB

/4
Size: 50KB - Virtual size: 50KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 20KB - Virtual size: 19KB

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 10KB - Virtual size: 9KB