398626f32e5cbeafd5f0105d760836f0403773789446afd18696ceb746e0db97

Sharing

Copy URL

Twitter E-mail

General

Target

398626f32e5cbeafd5f0105d760836f0403773789446afd18696ceb746e0db97
Size

1.3MB
MD5

77ab50357a7d93694f6d0984c3a12b1c
SHA1

885cb2a5d27b2eaba4d4a1d2bdc9cba6f031407b
SHA256

398626f32e5cbeafd5f0105d760836f0403773789446afd18696ceb746e0db97
SHA512

fb21afd55557e09a3b502addefced54f307bc4249f1dcc05855edf8e1c06de4aaccfa9a0ef5d6b0cd25daaca2da0e8ff9a4b740261a4034cb646fa9955835b97
SSDEEP

24576:vPP3uQs1pHcRG/Ir6KVc9t+//3hZBiXs5qbn1dA8mOB+ZfuigT3nkby+Y9m:PwVt+HhZBiXlXAuMZfuigT3nkbyI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
398626f32e5cbeafd5f0105d760836f0403773789446afd18696ceb746e0db97

Files

398626f32e5cbeafd5f0105d760836f0403773789446afd18696ceb746e0db97
.dll windows x86

448b7e9b25eaddac24b37ba582ab041d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
WSAIoctl
setsockopt
getsockname
ntohs
bind
getsockopt
getpeername
freeaddrinfo
getaddrinfo
connect
htons
closesocket
gethostbyname
socket
recv
send
WSACleanup
ioctlsocket
WSAStartup

kernel32

SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetProcessTimes
WTSGetActiveConsoleSessionId
SleepEx
FreeLibrary
WritePrivateProfileStringW
GetLocalTime
lstrcmpiW
FindFirstFileW
FindClose
TerminateThread
GetSystemDefaultLangID
lstrcpyW
WideCharToMultiByte
SetLastError
GlobalAlloc
GlobalFree
MoveFileW
OpenMutexW
CreateMutexW
GetModuleFileNameW
MoveFileExW
CopyFileW
FindFirstFileA
FindNextFileA
MultiByteToWideChar
FindNextFileW
FlushFileBuffers
WaitForMultipleObjects
GetSystemInfo
GetExitCodeProcess
GetWindowsDirectoryW
FreeResource
LoadLibraryExW
GetSystemWindowsDirectoryW
GetVersionExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
InterlockedDecrement
GlobalMemoryStatusEx
SetFileAttributesW
ReleaseMutex
GetVolumeInformationW
ExitThread
OpenEventW
GetFileTime
SystemTimeToFileTime
VirtualQuery
FlushInstructionCache
VirtualAlloc
VirtualFree
FindResourceW
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
DeviceIoControl
GetCurrentProcessId
SetFilePointer
GetTempPathW
CreateRemoteThread
VirtualProtectEx
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
InterlockedExchange
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
HeapCreate
RtlUnwind
GetCommandLineA
GetStdHandle
GetFileType
WriteConsoleW
UnhandledExceptionFilter
TlsFree
TlsAlloc
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeleteFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLastError
FindResourceExW
lstrlenA
LoadLibraryW
lstrlenW
TerminateProcess
VirtualAllocEx
GetFileSize
WriteProcessMemory
GetProcessId
CreateProcessW
GetFileAttributesA
GetSystemDirectoryW
RaiseException
CreateThread
WaitForSingleObject
ExitProcess
ResumeThread
LoadLibraryA
CreateFileA
OpenProcess
CheckRemoteDebuggerPresent
Sleep
GetTickCount
GetSystemTime
GetCurrentProcess
GetModuleHandleW
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
LocalFileTimeToFileTime
lstrcmpiA
lstrcmpA
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
InterlockedCompareExchange
InterlockedIncrement
WriteFile
HeapFree
CloseHandle
ReadFile
GetFileSizeEx
CreateFileW
HeapAlloc
GetProcessHeap
GetDriveTypeA
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
OpenThread

user32

wsprintfW
LoadCursorW
RegisterClassExW
CreateWindowExW
IsWindow
ShowWindow
CreatePopupMenu
AppendMenuW
GetCursorPos
SetForegroundWindow
TrackPopupMenu
PostMessageW
DestroyMenu
DestroyWindow
MessageBoxTimeoutW
DefWindowProcW
GetMessageW
FindWindowW
GetAncestor
WindowFromPoint
PostThreadMessageW
BlockInput
GetWindowRect
GetForegroundWindow
GetShellWindow
GetWindowInfo
TranslateMessage
DispatchMessageW
GetWindowThreadProcessId
LoadImageW
DestroyIcon
PostQuitMessage
GetActiveWindow
MoveWindow
SetWindowPos
MapWindowPoints
UnregisterClassA
GetDesktopWindow
GetWindow
EnumDisplaySettingsW
GetMonitorInfoW
MonitorFromPoint
SendMessageW
ReleaseCapture
SetCapture
PtInRect
ReleaseDC
EndDialog
DialogBoxParamW
InvalidateRect
DrawTextW
GetDC
EndPaint
BeginPaint
SetWindowLongW
SetTimer
GetWindowLongW
MonitorFromWindow
GetParent
GetClientRect

gdi32

CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
TextOutW
DeleteObject
SetTextColor
SelectObject
CreateFontW
SetBkMode
DeleteDC

advapi32

RegDeleteValueW
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegEnumKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegQueryValueExW
CreateProcessAsUserW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegFlushKey
RegCreateKeyExW
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyW
CryptCreateHash

shell32

SHGetFolderPathW
ord165
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathA
Shell_NotifyIconW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CreateStreamOnHGlobal
CoCreateGuid

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime

shlwapi

StrCmpIW
SHGetValueW
PathCombineW
StrStrW
PathAppendA
PathFileExistsA
PathRemoveFileSpecW
SHGetValueA
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathIsDirectoryW
wnsprintfW
StrTrimA
SHSetValueA
PathFindFileNameW
StrCmpNIW
StrCpyW
PathFileExistsW
StrCatW
SHDeleteValueW
SHSetValueW
StrStrIW
PathCombineA

crypt32

CryptStringToBinaryA
CryptBinaryToStringA
CertEnumCertificatesInStore
CertOpenStore
CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CryptBinaryToStringW
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject

setupapi

SetupIterateCabinetW

gdiplus

GdipDrawImageRectRectI
GdipFree
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipAlloc
GdipDisposeImage

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

HttpOpenRequestW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle
HttpAddRequestHeadersW
InternetCrackUrlW
InternetOpenW
InternetConnectW
InternetReadFile

psapi

GetModuleFileNameExW
GetModuleFileNameExA
EnumProcessModules

msimg32

AlphaBlend

netapi32

NetWkstaGetInfo
NetApiBufferFree

Exports

Exports

BrowserLaunch
Do505_Impl
Is360ZipExist
IsBrowserInstalled
IsBrowserInstalled2
IsDesktopLiteExist
IsInDenyPidList
IsNeedInstallSafe
IsPalmInputExist
IsSDExist
IsSafeExist
IsSafeExist2
Report_D5S
SetCurrentModuleInformations
Start
Start360Zip
Start360Zip_UI
StartBrower_UI
StartDesktopLite
StartDesktopLite_UI
StartPalmInput
StartPalmInput_UI
StartSD
StartSD_UI
StartSafe_UI
Start_UI
TestUI
dkeaoaskeugn
do505
do505_ktctl

Sections

.text
Size: 857KB - Virtual size: 856KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

448b7e9b25eaddac24b37ba582ab041d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

setupapi

gdiplus

version

userenv

wininet

psapi

msimg32

netapi32

Exports

Exports

Sections

.text Size: 857KB - Virtual size: 856KB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 173KB - Virtual size: 225KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 857KB - Virtual size: 856KB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 173KB - Virtual size: 225KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 66KB - Virtual size: 65KB