dafd5f8fce296e7a4eef6a67bbe42fc19edeb388a2ff631b576e4fdb0644b99b

Sharing

Copy URL Twitter E-mail

General

Target

dafd5f8fce296e7a4eef6a67bbe42fc19edeb388a2ff631b576e4fdb0644b99b
Size

698KB
MD5

2210a1eead78f8054eac6eff910402c1
SHA1

cb4f3fdc9d1cef254b7448ecd0e20a94ffe33cd6
SHA256

dafd5f8fce296e7a4eef6a67bbe42fc19edeb388a2ff631b576e4fdb0644b99b
SHA512

a63a5e4a2f7f03f403ffe3a5e59486b131f3ea8af8f58a5eb574d25d93837398dffdd1127186c7f673fcd8de18f87ecd1cfd4d8d56f8e8a53717fe1665241d07
SSDEEP

12288:YP4mbi7tqpQuyniueya0aUbOoqeMZJprAkjUMIu4UjeC5zhm:eXWqZyiueya0aUbOoqeMZJpsk4MLjiCe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dafd5f8fce296e7a4eef6a67bbe42fc19edeb388a2ff631b576e4fdb0644b99b

Files

dafd5f8fce296e7a4eef6a67bbe42fc19edeb388a2ff631b576e4fdb0644b99b
.dll windows x86

5ab3f73de506be87f6e3eff6eae69daf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

nssutil3

NSS_SecureMemcmp
NSS_SecureMemcmpZero
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_SetError_Util
PORT_ZAllocAlignedOffset_Util
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_FreeItem_Util
SECITEM_ItemsAreEqual_Util
SECITEM_ZfreeItem_Util
SECOID_FindOIDTag_Util

advapi32

SystemFunction036

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetLastError
GetLogicalDrives
GetModuleHandleA
GetProcAddress
GetTickCount
GetVolumeInformationA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

_amsg_exit
_initterm
_iob
_lock
_strdup
_unlock
abort
calloc
free
fwrite
islower
isupper
malloc
memcpy
memmove
memset
memcmp
rand
realloc
strcmp
strlen
strncmp
time
tolower
toupper
vfprintf

libnspr4

PR_CallOnce
PR_Close
PR_DestroyCondVar
PR_DestroyLock
PR_Free
PR_GetEnvSecure
PR_GetLibraryFilePathname
PR_Lock
PR_NewCondVar
PR_NewLock
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Open
PR_Read
PR_Seek
PR_Unlock
PR_WaitCondVar

Exports

Exports

AESKeyWrap_AllocateContext
AESKeyWrap_CreateContext
AESKeyWrap_Decrypt
AESKeyWrap_DecryptKWP
AESKeyWrap_DestroyContext
AESKeyWrap_Encrypt
AESKeyWrap_EncryptKWP
AESKeyWrap_InitContext
AESKeyWrap_W
AESKeyWrap_Winv
AES_AEAD
AES_AllocateContext
AES_CreateContext
AES_Decrypt
AES_DestroyContext
AES_Encrypt
AES_InitContext
BLAKE2B_Begin
BLAKE2B_Clone
BLAKE2B_DestroyContext
BLAKE2B_End
BLAKE2B_Flatten
BLAKE2B_FlattenSize
BLAKE2B_Hash
BLAKE2B_HashBuf
BLAKE2B_MAC_Begin
BLAKE2B_MAC_HashBuf
BLAKE2B_NewContext
BLAKE2B_Resurrect
BLAKE2B_Update
BLAPI_SHVerify
BLAPI_SHVerifyFile
BLAPI_VerifySelf
BL_Cleanup
BL_FIPSEntryOK
BL_Init
BL_POSTRan
BL_SetForkState
CMAC_Begin
CMAC_Create
CMAC_Destroy
CMAC_Finish
CMAC_Init
CMAC_Update
CTR_CreateContext
CTR_DestroyContext
CTR_InitContext
CTR_Update
CTS_CreateContext
CTS_DecryptUpdate
CTS_DestroyContext
CTS_EncryptUpdate
Camellia_AllocateContext
Camellia_CreateContext
Camellia_Decrypt
Camellia_DestroyContext
Camellia_Encrypt
Camellia_InitContext
ChaCha20Poly1305_CreateContext
ChaCha20Poly1305_Decrypt
ChaCha20Poly1305_DestroyContext
ChaCha20Poly1305_Encrypt
ChaCha20Poly1305_InitContext
ChaCha20Poly1305_Open
ChaCha20Poly1305_Seal
ChaCha20Xor
ChaCha20_CreateContext
ChaCha20_DestroyContext
ChaCha20_InitContext
ChaCha20_Xor
CheckX86CPUSupport
DES_AllocateContext
DES_CreateContext
DES_Decrypt
DES_DestroyContext
DES_Do1Block
DES_Encrypt
DES_InitContext
DES_MakeSchedule
DH_Derive
DH_GenParam
DH_NewKey
DSA_NewKey
DSA_NewKeyFromSeed
DSA_NewRandom
DSA_SignDigest
DSA_SignDigestWithSeed
DSA_VerifyDigest
ECDH_Derive
ECDSA_SignDigest
ECDSA_SignDigestWithSeed
ECDSA_VerifyDigest
ECGroup_consGFp
ECGroup_consGFp_mont
ECGroup_free
ECGroup_fromName
ECGroup_new
ECPoint_mul
ECPoint_validate
ECPoints_mul
EC_CopyParams
EC_DecodeParams
EC_FillParams
EC_GetPointSize
EC_NewKey
EC_NewKeyFromSeed
EC_ValidatePublicKey
FIPS186Change_GenerateX
FIPS186Change_ReduceModQForDSA
FREEBL_Deprecated
FREEBL_GetVector
GCM_CreateContext
GCM_DecryptAEAD
GCM_DecryptUpdate
GCM_DestroyContext
GCM_EncryptAEAD
GCM_EncryptUpdate
GFMethod_consGFp
GFMethod_consGFp_mont
GFMethod_free
GFMethod_new
HASH_GetRawHashObject
HMAC_Begin
HMAC_Clone
HMAC_ConstantTime
HMAC_Create
HMAC_Destroy
HMAC_Finish
HMAC_Init
HMAC_ReInit
HMAC_Update
Hacl_Chacha20Poly1305_32_aead_decrypt
Hacl_Chacha20Poly1305_32_aead_encrypt
Hacl_Chacha20_chacha20_decrypt
Hacl_Chacha20_chacha20_encrypt
Hacl_Impl_Chacha20_Vec_chacha20_constants
Hacl_Poly1305_32_blocklen
Hacl_Poly1305_32_poly1305_finish
Hacl_Poly1305_32_poly1305_init
Hacl_Poly1305_32_poly1305_mac
Hacl_Poly1305_32_poly1305_update
Hacl_Poly1305_32_poly1305_update1
JPAKE_Final
JPAKE_Round2
JPAKE_Sign
JPAKE_Verify
KEA_Derive
KEA_PrimeCheck
KEA_Verify
MD2_Begin
MD2_Clone
MD2_DestroyContext
MD2_End
MD2_Flatten
MD2_FlattenSize
MD2_Hash
MD2_NewContext
MD2_Resurrect
MD2_Update
MD5_Begin
MD5_Clone
MD5_DestroyContext
MD5_End
MD5_EndRaw
MD5_Flatten
MD5_FlattenSize
MD5_Hash
MD5_HashBuf
MD5_NewContext
MD5_Resurrect
MD5_TraceState
MD5_Update
PQG_Check
PQG_DestroyParams
PQG_DestroyVerify
PQG_GetHashType
PQG_GetLength
PQG_ParamGen
PQG_ParamGenSeedLen
PQG_ParamGenV2
PQG_VerifyParams
PRNGTEST_Generate
PRNGTEST_Instantiate
PRNGTEST_Instantiate_Kat
PRNGTEST_Reseed
PRNGTEST_RunHealthTests
PRNGTEST_Uninstantiate
RC2_AllocateContext
RC2_CreateContext
RC2_Decrypt
RC2_DestroyContext
RC2_Encrypt
RC2_InitContext
RC4_AllocateContext
RC4_CreateContext
RC4_Decrypt
RC4_DestroyContext
RC4_Encrypt
RC4_InitContext
RC5_CreateContext
RC5_Decrypt
RC5_DestroyContext
RC5_Encrypt
RNG_GenerateGlobalRandomBytes
RNG_GetNoise
RNG_RNGInit
RNG_RNGShutdown
RNG_RandomUpdate
RNG_SystemInfoForRNG
RNG_SystemRNG
RSA_CheckSign
RSA_CheckSignPSS
RSA_CheckSignRaw
RSA_CheckSignRecover
RSA_CheckSignRecoverRaw
RSA_Cleanup
RSA_DecryptBlock
RSA_DecryptOAEP
RSA_DecryptRaw
RSA_EncryptBlock
RSA_EncryptOAEP
RSA_EncryptRaw
RSA_Init
RSA_NewKey
RSA_PopulatePrivateKey
RSA_PrivateKeyCheck
RSA_PrivateKeyOp
RSA_PrivateKeyOpDoubleChecked
RSA_PublicKeyOp
RSA_Sign
RSA_SignPSS
RSA_SignRaw
SECRawHashObjects
SEED_AllocateContext
SEED_CreateContext
SEED_Decrypt
SEED_DestroyContext
SEED_Encrypt
SEED_InitContext
SEED_cbc_encrypt
SEED_decrypt
SEED_ecb_encrypt
SEED_encrypt
SEED_set_key
SHA1_Begin
SHA1_Clone
SHA1_Compress_Native
SHA1_DestroyContext
SHA1_End
SHA1_EndRaw
SHA1_Flatten
SHA1_FlattenSize
SHA1_Hash
SHA1_HashBuf
SHA1_NewContext
SHA1_Resurrect
SHA1_TraceState
SHA1_Update
SHA1_Update_Native
SHA224_Begin
SHA224_Clone
SHA224_DestroyContext
SHA224_End
SHA224_EndRaw
SHA224_Flatten
SHA224_FlattenSize
SHA224_Hash
SHA224_HashBuf
SHA224_NewContext
SHA224_Resurrect
SHA224_TraceState
SHA224_Update
SHA256_Begin
SHA256_Clone
SHA256_Compress_Native
SHA256_DestroyContext
SHA256_End
SHA256_EndRaw
SHA256_Flatten
SHA256_FlattenSize
SHA256_Hash
SHA256_HashBuf
SHA256_NewContext
SHA256_Resurrect
SHA256_TraceState
SHA256_Update
SHA256_Update_Native
SHA384_Begin
SHA384_Clone
SHA384_DestroyContext
SHA384_End
SHA384_EndRaw
SHA384_Flatten
SHA384_FlattenSize
SHA384_Hash
SHA384_HashBuf
SHA384_NewContext
SHA384_Resurrect
SHA384_TraceState
SHA384_Update
SHA512_Begin
SHA512_Clone
SHA512_DestroyContext
SHA512_End
SHA512_EndRaw
SHA512_Flatten
SHA512_FlattenSize
SHA512_Hash
SHA512_HashBuf
SHA512_NewContext
SHA512_Resurrect
SHA512_TraceState
SHA512_Update
SSLv3_MAC_ConstantTime
TLS_PRF
TLS_P_hash
__nss_freebl_version
aesni_support
arm_aes_support
arm_neon_support
arm_pmull_support
arm_sha1_support
arm_sha2_support
avx2_support
avx_support
bl_parentForkedAfterC_Initialize
blake2b_Compress
blake2b_HashBuf
blake2b_IncrementCounter
bmul32
camellia_decrypt128
camellia_decrypt256
camellia_decryptCBC
camellia_decryptECB
camellia_encrypt128
camellia_encrypt256
camellia_encryptCBC
camellia_encryptECB
camellia_key_expansion
camellia_setup128
camellia_setup192
camellia_setup256
clmul_support
construct_ecgroup
ec_Curve25519_mul
ec_Curve25519_pt_mul
ec_Curve25519_pt_validate
ec_GF2m_add
ec_GF2m_div
ec_GF2m_mod
ec_GF2m_mul
ec_GF2m_neg
ec_GF2m_sqr
ec_GFp_add
ec_GFp_add_3
ec_GFp_add_4
ec_GFp_add_5
ec_GFp_add_6
ec_GFp_dec_mont
ec_GFp_div
ec_GFp_div_mont
ec_GFp_enc_mont
ec_GFp_extra_free_mont
ec_GFp_mod
ec_GFp_mul
ec_GFp_mul_mont
ec_GFp_neg
ec_GFp_pt_add_aff
ec_GFp_pt_add_jac_aff
ec_GFp_pt_aff2jac
ec_GFp_pt_dbl_aff
ec_GFp_pt_dbl_jac
ec_GFp_pt_is_inf_aff
ec_GFp_pt_is_inf_jac
ec_GFp_pt_jac2aff
ec_GFp_pt_mul_jm_wNAF
ec_GFp_pt_set_inf_aff
ec_GFp_pt_set_inf_jac
ec_GFp_pt_sub_aff
ec_GFp_pts_mul_jac
ec_GFp_sqr
ec_GFp_sqr_mont
ec_GFp_sub
ec_GFp_sub_3
ec_GFp_sub_4
ec_GFp_sub_5
ec_GFp_sub_6
ec_GFp_validate_point
ec_GetNamedCurveParams
ec_NewKey
ec_compute_wNAF
ec_group_set_gfp256
ec_group_set_gfp256_32
ec_group_set_gfp384
ec_group_set_gfp521
ec_group_set_secp384r1
ec_group_set_secp521r1
ec_point_at_infinity
ec_points_mul
ec_pts_mul_basic
ec_pts_mul_simul_w2
ec_twoTo
ecgroup_fromName
freebl_cpuid
freebl_fips_TLS_PowerUpSelfTest
gcmHash_Final
gcmHash_InitContext
gcmHash_Reset
gcmHash_Update
gcm_GenerateIV
gcm_HashInit_hw
gcm_HashMult_hw
gcm_HashMult_sftw32
gcm_HashWrite_hw
gcm_HashZeroX_hw
gcm_InitCounter
gcm_InitIVContext
generate_prime
get64
mp_2expt
mp_abs
mp_add
mp_add_d
mp_addmod
mp_badd
mp_barr2poly
mp_bdivmod
mp_bmod
mp_bmul
mp_bmulmod
mp_bpoly2arr
mp_bsqrmod
mp_clear
mp_cmp
mp_cmp_d
mp_cmp_mag
mp_cmp_z
mp_copy
mp_cswap
mp_div
mp_div_2
mp_div_2d
mp_div_d
mp_exch
mp_expt
mp_expt_d
mp_exptmod
mp_exptmod_d
mp_exptmod_i
mp_exptmod_safe_i
mp_gcd
mp_get_prec
mp_gf2m_sqr_tb
mp_init
mp_init_copy
mp_init_size
mp_invmod
mp_invmod_xgcd
mp_iseven
mp_isodd
mp_lcm
mp_mod
mp_mod_d
mp_mul
mp_mul_2
mp_mul_d
mp_mulmod
mp_neg
mp_radix_size
mp_raw_size
mp_read_radix
mp_read_raw
mp_read_unsigned_octets
mp_read_variable_radix
mp_set
mp_set_int
mp_set_prec
mp_set_safe_modexp
mp_set_ulong
mp_sqr
mp_sqrmod
mp_strerror
mp_sub
mp_sub_d
mp_submod
mp_to_fixlen_octets
mp_to_signed_octets
mp_to_unsigned_octets
mp_toradix
mp_toraw
mp_tovalue
mp_trailing_zeros
mp_unsigned_octet_size
mp_using_cache_safe_exp
mp_xgcd
mp_zero
mpi_to_weave
mpl_and
mpl_get_bit
mpl_get_bits

Sections

.text
Size: 489KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ab3f73de506be87f6e3eff6eae69daf

Headers

DLL Characteristics

File Characteristics

Imports

nssutil3

advapi32

kernel32

msvcrt

libnspr4

Exports

Exports

Sections

.text Size: 489KB - Virtual size: 488KB

.data Size: 512B - Virtual size: 452B

.rdata Size: 135KB - Virtual size: 134KB

/4 Size: 41KB - Virtual size: 41KB

.bss Size: - Virtual size: 16KB

.edata Size: 15KB - Virtual size: 15KB

.idata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 800B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 489KB - Virtual size: 488KB

.data
Size: 512B - Virtual size: 452B

.rdata
Size: 135KB - Virtual size: 134KB

/4
Size: 41KB - Virtual size: 41KB

.bss
Size: - Virtual size: 16KB

.edata
Size: 15KB - Virtual size: 15KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 800B

.reloc
Size: 7KB - Virtual size: 6KB