827a4c7c77866e66fae0631dc1cbc5b7ba5977f24724ff371404b844a00567f4

Sharing

Copy URL Twitter E-mail

General

Target

827a4c7c77866e66fae0631dc1cbc5b7ba5977f24724ff371404b844a00567f4
Size

3.8MB
MD5

0812b6b9de7b55cb6b2a571359eac608
SHA1

594f91d65eaab482108f304a45a5aafc077b18e4
SHA256

827a4c7c77866e66fae0631dc1cbc5b7ba5977f24724ff371404b844a00567f4
SHA512

3b242436cc6d099b75d4dca4960dbfdf7fc20b94a3aa2a58cb3e6270848d7bf71593af423d611e19e6f01c1bdfda0b3e04751bd4586e157e4a21d385b3e1936d
SSDEEP

98304:BY+UeuJ942T3NglkYYUjVjC/Hf6juCNDl:e+9uJ94wguUjlWHfWJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
827a4c7c77866e66fae0631dc1cbc5b7ba5977f24724ff371404b844a00567f4

Files

827a4c7c77866e66fae0631dc1cbc5b7ba5977f24724ff371404b844a00567f4
.dll windows x64

a5b074f0cfda96daf5d92b806ca12127

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW
lstrcmpW
WritePrivateProfileStringW
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
IsBadCodePtr
GetThreadContext
ResumeThread
SuspendThread
GetPrivateProfileIntW
lstrcmpiW
GlobalFree
GetCurrentThread
Sleep
GetLastError
SetLastError
CreateThread
WriteConsoleW
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetPrivateProfileStringW
GetACP
IsValidCodePage
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
HeapFree
HeapAlloc
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetFilePointerEx
GetFileInformationByHandle
GetDriveTypeW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
CreateDirectoryW
GetFileAttributesExW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
GetTickCount
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetLocalTime
FreeLibrary
GetProcAddress
LoadLibraryW
MoveFileExW
FindClose
FindFirstFileW
GetOEMCP
DeleteFileW
WaitForSingleObjectEx
GetNativeSystemInfo
GetStringTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InitializeSListHead
FormatMessageW
SleepEx
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
RtlUnwind
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MapVirtualKeyW
VkKeyScanW
SendInput
GetForegroundWindow
SetWindowTextW
GetWindowRect
EnumWindows
GetWindow
GetWindowThreadProcessId
GetClassNameW
DefWindowProcW
SendMessageW
PostQuitMessage
ChangeWindowMessageFilterEx
RegisterClassExW
CreateWindowExW

shell32

ShellExecuteW
CommandLineToArgvW

shlwapi

PathIsDirectoryW

ws2_32

WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
recv
bind
connect
getpeername
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
getsockname

wldap32

ord33
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord35
ord79
ord301
ord30
ord200
ord32

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CertCloseStore
CertOpenStore
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain

advapi32

CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptEncrypt

Sections

.text
Size: - Virtual size: 972KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.::T
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.).p
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.f+l
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5b074f0cfda96daf5d92b806ca12127

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

ws2_32

wldap32

crypt32

advapi32

Sections

.text Size: - Virtual size: 972KB

.rdata Size: - Virtual size: 219KB

.data Size: - Virtual size: 32KB

.pdata Size: - Virtual size: 40KB

.detourc Size: - Virtual size: 8KB

.detourd Size: - Virtual size: 24B

_RDATA Size: - Virtual size: 348B

.::T Size: - Virtual size: 1.4MB

.).p Size: 3KB - Virtual size: 2KB

.f+l Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 512B - Virtual size: 224B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 972KB

.rdata
Size: - Virtual size: 219KB

.data
Size: - Virtual size: 32KB

.pdata
Size: - Virtual size: 40KB

.detourc
Size: - Virtual size: 8KB

.detourd
Size: - Virtual size: 24B

_RDATA
Size: - Virtual size: 348B

.::T
Size: - Virtual size: 1.4MB

.).p
Size: 3KB - Virtual size: 2KB

.f+l
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 512B - Virtual size: 224B

.rsrc
Size: 1KB - Virtual size: 1KB