6a37089a1d39aa49e8d94139ab02c7c8fcd5f1d5c8d6365acb970983bef15108

Sharing

Copy URL

Twitter E-mail

General

Target

6a37089a1d39aa49e8d94139ab02c7c8fcd5f1d5c8d6365acb970983bef15108
Size

579KB
MD5

af9873450f77864bf99820f723ad4540
SHA1

5372070aa18c8c076bb4d871f2a15383fdd60f80
SHA256

6a37089a1d39aa49e8d94139ab02c7c8fcd5f1d5c8d6365acb970983bef15108
SHA512

661717368a5303555a59a6164d5a7dc359c798a45d702a5fc51cab9158ef25da5b76c9e813cf3bb9efe8f77e0cb370a2c54d72218e5349662a59d375725ac154
SSDEEP

12288:pJX3boaxSC23BHMUt7kRTSD6i9w2ejJ3xz1y458BD5uX9YNlmnILeTs5QjAsDkTI:nX3bTSD6iwLNy4582YNlmq5eITbU4HD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a37089a1d39aa49e8d94139ab02c7c8fcd5f1d5c8d6365acb970983bef15108

Files

6a37089a1d39aa49e8d94139ab02c7c8fcd5f1d5c8d6365acb970983bef15108
.dll windows x86

2d4b6a0ec16549777471e87cb54127f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

gethostbyname
gethostname
inet_ntoa

kernel32

SetFileAttributesW
GetTickCount
CopyFileW
CreateFileW
FlushFileBuffers
WriteFile
CloseHandle
GetLastError
Sleep
GetWindowsDirectoryW
FreeLibrary
FreeResource
GetProcAddress
LoadResource
LockResource
SizeofResource
LoadLibraryA
LoadLibraryW
FindResourceA
TerminateProcess
ResumeThread
CreateProcessW
CreateFileA
GetFileInformationByHandle
GetFileSize
ReadFile
SetFilePointer
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
FileTimeToSystemTime
SystemTimeToFileTime
ReleaseMutex
CreateMutexA
DisableThreadLibraryCalls
GetCurrentDirectoryW
CreateDirectoryW
FindNextFileW
GetFileAttributesExW
GetFileAttributesW
SetUnhandledExceptionFilter
CreatePipe
DeviceIoControl
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
GetCurrentProcessId
CreateThread
CreateRemoteThread
GetCurrentThreadId
SetThreadPriority
GetExitCodeThread
CreateProcessA
OpenProcess
VirtualProtect
VirtualQuery
VirtualAllocEx
WriteProcessMemory
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
CreateSemaphoreA
OpenFileMappingA
GetLogicalDriveStringsA
MoveFileW
GetTimeZoneInformation
SetConsoleCtrlHandler
GetVersionExA
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FindFirstFileW
FindClose
DeleteFileW
WaitForSingleObjectEx
ResetEvent
SetEvent
RemoveDirectoryW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
LocalFree

user32

GetWindowTextA
FindWindowA
EnumWindows
GetClassNameA
GetDesktopWindow
GetSystemMetrics
GetWindowThreadProcessId
EnumDisplayMonitors

advapi32

RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExW

shell32

ShellExecuteW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

GetErrorInfo
SysAllocString
SysFreeString
VariantClear
VariantChangeType
CreateErrorInfo
SetErrorInfo
VariantInit

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

__std_type_info_destroy_list
memmove
__current_exception
__current_exception_context
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

exit
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
terminate
_exit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit

api-ms-win-crt-stdio-l1-1-0

fflush
__acrt_iob_func
__stdio_common_vsprintf
fopen
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vfprintf
fwrite
fclose
fread
feof
fseek
_open_osfhandle
fgets
_wfopen
ftell

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
realloc

api-ms-win-crt-convert-l1-1-0

mbstowcs
wcstombs

api-ms-win-crt-filesystem-l1-1-0

_wchmod
_wstat64i32

api-ms-win-crt-string-l1-1-0

strncpy
isspace
tolower
_wcslwr
_strlwr

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy

api-ms-win-crt-time-l1-1-0

_time64
_localtime64

api-ms-win-crt-math-l1-1-0

_except1
_fdopen

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

GetIFactory

Sections

.text
Size: 462KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d4b6a0ec16549777471e87cb54127f8

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 462KB - Virtual size: 461KB

.rdata Size: 93KB - Virtual size: 93KB

.data Size: 2KB - Virtual size: 25KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 462KB - Virtual size: 461KB

.rdata
Size: 93KB - Virtual size: 93KB

.data
Size: 2KB - Virtual size: 25KB

.reloc
Size: 21KB - Virtual size: 20KB