bfc30e4fcbe9a787d6c0ff6607211e0f86bc1362994dc43cf046933ebfbfe0ed

Sharing

Copy URL Twitter E-mail

General

Target

bfc30e4fcbe9a787d6c0ff6607211e0f86bc1362994dc43cf046933ebfbfe0ed
Size

271KB
MD5

26f6597f0d4fe07a7814830885824959
SHA1

ba8f07830739c4a8f167644a1d2bb6c85bf160a2
SHA256

bfc30e4fcbe9a787d6c0ff6607211e0f86bc1362994dc43cf046933ebfbfe0ed
SHA512

8cfeb5231732775d492077908571041f18b519c60208e0a08b1fe0ce3aa67e4ae16e3b96a3ed1bf702772b01946c801dfa46ebbd4af12db4662ba959f02973e1
SSDEEP

6144:RazcARqfIc5TETkcLBtNRLkxjYyRiZ5rLQsuZ8P:RaYS+Ic5TSkcLbNRug

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfc30e4fcbe9a787d6c0ff6607211e0f86bc1362994dc43cf046933ebfbfe0ed

Files

bfc30e4fcbe9a787d6c0ff6607211e0f86bc1362994dc43cf046933ebfbfe0ed
.dll windows x86

d4295ad1550a10d69c953bd88a9acd88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

libgcc_s_dw2-1

_Unwind_Resume
__deregister_frame_info
__register_frame_info

kernel32

CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetFileSize
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
Sleep
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__mb_cur_max
__setusermatherr
_amsg_exit
_assert
_errno
_initterm
_iob
_lock
_unlock
abort
atoi
calloc
fputc
free
fwrite
getenv
localeconv
malloc
memcpy
memmove
memset
memcmp
realloc
setlocale
strchr
strcmp
strcpy
strerror
strlen
strncmp
vfprintf
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsncpy
wcsstr

shell32

SHGetFolderPathA

libstdc++-6

_ZNKSt5ctypeIcE13_M_widen_initEv
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcjj
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEPKcjj
_ZNSdD2Ev
_ZNSo9_M_insertIdEERSoT_
_ZNSt12__basic_fileIcED1Ev
_ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKcSt13_Ios_Openmode
_ZNSt13basic_filebufIcSt11char_traitsIcEE5closeEv
_ZNSt13basic_filebufIcSt11char_traitsIcEEC1Ev
_ZNSt13basic_filebufIcSt11char_traitsIcEED1Ev
_ZNSt13basic_ostreamIwSt11char_traitsIwEE3putEw
_ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev
_ZNSt14basic_iostreamIwSt11char_traitsIwEED2Ev
_ZNSt6localeC1Ev
_ZNSt6localeD1Ev
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEjjPKcj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE8_M_eraseEjj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERjj
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_disposeEv
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEjjPKwj
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERjj
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEE7_M_syncEPcjj
_ZNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEED1Ev
_ZNSt7__cxx1118basic_stringstreamIwSt11char_traitsIwESaIwEED1Ev
_ZNSt8__detail15_List_node_base11_M_transferEPS0_S1_
_ZNSt8__detail15_List_node_base7_M_hookEPS0_
_ZNSt8__detail15_List_node_base9_M_unhookEv
_ZNSt8ios_baseC2Ev
_ZNSt8ios_baseD2Ev
_ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E
_ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate
_ZNSt9basic_iosIwSt11char_traitsIwEE4initEPSt15basic_streambufIwS1_E
_ZNSt9exceptionD2Ev
_ZSt16__ostream_insertIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_i
_ZSt16__throw_bad_castv
_ZSt17__throw_bad_allocv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt24__throw_out_of_range_fmtPKcz
_ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EES4_
_ZTTNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE
_ZTTNSt7__cxx1118basic_stringstreamIwSt11char_traitsIwESaIwEEE
_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1115basic_stringbufIwSt11char_traitsIwESaIwEEE
_ZTVNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1118basic_stringstreamIwSt11char_traitsIwESaIwEEE
_ZTVSt13basic_filebufIcSt11char_traitsIcEE
_ZTVSt14basic_ifstreamIcSt11char_traitsIcEE
_ZTVSt15basic_streambufIcSt11char_traitsIcEE
_ZTVSt15basic_streambufIwSt11char_traitsIwEE
_ZTVSt9basic_iosIcSt11char_traitsIcEE
_ZTVSt9basic_iosIwSt11char_traitsIwEE
_ZdaPv
_ZdlPvj
_Znaj
_Znwj
__cxa_allocate_exception
__cxa_begin_catch
__cxa_end_catch
__cxa_free_exception
__cxa_rethrow
__cxa_throw
__cxa_throw_bad_array_new_length
__gxx_personality_v0

Exports

Exports

voikkoAnalyzeWordCstr
voikkoAnalyzeWordUcs4
voikkoFreeCstr
voikkoFreeCstrArray
voikkoFreeErrorMessageCstr
voikkoFreeGrammarError
voikkoGetAttributeValues
voikkoGetGrammarErrorCode
voikkoGetGrammarErrorLength
voikkoGetGrammarErrorShortDescription
voikkoGetGrammarErrorStartPos
voikkoGetGrammarErrorSuggestions
voikkoGetVersion
voikkoHyphenateCstr
voikkoHyphenateUcs4
voikkoInit
voikkoInsertHyphensCstr
voikkoListSupportedGrammarCheckingLanguages
voikkoListSupportedHyphenationLanguages
voikkoListSupportedSpellingLanguages
voikkoNextGrammarErrorCstr
voikkoNextGrammarErrorUcs4
voikkoNextSentenceStartCstr
voikkoNextSentenceStartUcs4
voikkoNextTokenCstr
voikkoNextTokenUcs4
voikkoSetBooleanOption
voikkoSetIntegerOption
voikkoSpellCstr
voikkoSpellUcs4
voikkoSuggestCstr
voikkoSuggestUcs4
voikkoTerminate
voikko_analyze_word_cstr
voikko_analyze_word_ucs4
voikko_dict_description
voikko_dict_language
voikko_dict_script
voikko_dict_variant
voikko_error_message_cstr
voikko_free_dicts
voikko_free_hyphenate
voikko_free_mor_analysis
voikko_free_mor_analysis_value_cstr
voikko_free_suggest_cstr
voikko_free_suggest_ucs4
voikko_hyphenate_cstr
voikko_hyphenate_ucs4
voikko_init
voikko_init_with_path
voikko_list_dicts
voikko_mor_analysis_keys
voikko_mor_analysis_value_cstr
voikko_mor_analysis_value_ucs4
voikko_next_grammar_error_cstr
voikko_next_grammar_error_ucs4
voikko_next_sentence_start_cstr
voikko_next_sentence_start_ucs4
voikko_next_token_cstr
voikko_next_token_ucs4
voikko_set_bool_option
voikko_set_int_option
voikko_set_string_option
voikko_spell_cstr
voikko_spell_ucs4
voikko_suggest_cstr
voikko_suggest_ucs4
voikko_terminate

Sections

.text
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4295ad1550a10d69c953bd88a9acd88

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

libgcc_s_dw2-1

kernel32

msvcrt

shell32

libstdc++-6

Exports

Exports

Sections

.text Size: 178KB - Virtual size: 178KB

.data Size: 512B - Virtual size: 316B

.rdata Size: 25KB - Virtual size: 25KB

/4 Size: 41KB - Virtual size: 40KB

.bss Size: - Virtual size: 2KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 178KB - Virtual size: 178KB

.data
Size: 512B - Virtual size: 316B

.rdata
Size: 25KB - Virtual size: 25KB

/4
Size: 41KB - Virtual size: 40KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 4KB - Virtual size: 4KB