3512f2932142ae4c7b202dbf6786ceae3ad8bb45a10cae63d4528180cb98f626

Sharing

Copy URL Twitter E-mail

General

Target

3512f2932142ae4c7b202dbf6786ceae3ad8bb45a10cae63d4528180cb98f626
Size

545KB
MD5

581cf5543935c4dc7bf45e9915591fda
SHA1

d7554ccf87ea941c3290c13b600ffda76d9b698f
SHA256

3512f2932142ae4c7b202dbf6786ceae3ad8bb45a10cae63d4528180cb98f626
SHA512

d28f5c166ae888bbd25f6aa321160dcd3f64e06737e7407c92233bf4215341c66bd40e8f98f0b56c952ffe677a4821edd0ecc36dd786dd4cb72116ef7f193c2b
SSDEEP

12288:MKqWi/rn3m4AWzPPsPqbBMkp04EPufHqOlBo7k3cFFcj00xxEEEE7LWmGVVVVII8:MKJi/rn3myDsUwBT5pdTvJU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3512f2932142ae4c7b202dbf6786ceae3ad8bb45a10cae63d4528180cb98f626

Files

3512f2932142ae4c7b202dbf6786ceae3ad8bb45a10cae63d4528180cb98f626
.dll windows x86

5bc8fd704e65d451ebb18d81b35b9f6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select
__WSAFDIsSet
send
freeaddrinfo
sendto
socket
WSAGetLastError
getsockopt
WSAStartup
WSACleanup
getnameinfo
recvfrom
recv
ntohs
listen
inet_addr
htons
htonl
getsockname
ioctlsocket
connect
closesocket
bind
accept
getaddrinfo

kernel32

IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
TerminateProcess
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
LocalFree
IsProcessorFeaturePresent
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
GetSystemTimeAsFileTime
GetModuleFileNameW
GetVersionExA
SetConsoleCtrlHandler
DisableThreadLibraryCalls
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
OpenEventA
Sleep
GetCurrentProcessId
GetExitCodeProcess
OpenProcess
GetCurrentDirectoryW
CreateDirectoryW
CreateFileA
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesExW
RemoveDirectoryW
SetUnhandledExceptionFilter
GetLastError
CreatePipe
DeviceIoControl
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
CreateThread
CreateRemoteThread
GetCurrentThreadId
SetThreadPriority
GetExitCodeThread
ResumeThread
CreateProcessA
GetTickCount
VirtualProtect
VirtualQuery
VirtualAllocEx
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetProcAddress
LoadLibraryA
LoadLibraryW
CreateSemaphoreA
CreateFileMappingA
OpenFileMappingA
GetLogicalDriveStringsA
CopyFileW
MoveFileW
GetTimeZoneInformation

user32

FindWindowA
EnumWindows
GetClassNameA
GetWindowThreadProcessId
GetSystemMetrics
GetWindowTextA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegCreateKeyExA

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SetErrorInfo
VariantClear
SysFreeString
SysAllocString
GetErrorInfo
VariantInit
VariantChangeType
CreateErrorInfo

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

memmove
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
memset
_except_handler4_common
__current_exception
__current_exception_context
__std_type_info_destroy_list
memcpy
__std_exception_copy
_purecall
__std_terminate

api-ms-win-crt-runtime-l1-1-0

terminate
_initterm
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_exit
exit
_cexit
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstombs
mbstowcs

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vfprintf
fwrite
ftell
fflush
fopen
fseek
fread
__stdio_common_vswprintf
fclose
feof
_wfopen
fgets
_open_osfhandle
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

_strlwr
_wcslwr
isspace
tolower

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64
_localtime64
_mktime64
_difftime64

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wchmod
_wstat64i32

Exports

Exports

GetIFactory

Sections

.text
Size: 459KB - Virtual size: 458KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5bc8fd704e65d451ebb18d81b35b9f6f

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 459KB - Virtual size: 458KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 3KB - Virtual size: 279KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 459KB - Virtual size: 458KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 3KB - Virtual size: 279KB

.reloc
Size: 17KB - Virtual size: 17KB