c3a577567b80094709c6e0d912bca0af32d445011bac57e369c57c85432a0cf7

Sharing

Copy URL

Twitter E-mail

General

Target

c3a577567b80094709c6e0d912bca0af32d445011bac57e369c57c85432a0cf7
Size

563KB
MD5

bcfa4a2650862f27c2e1ddfbe43a654f
SHA1

5ec8c10f9ddb99cfd433232c315a25b652970a17
SHA256

c3a577567b80094709c6e0d912bca0af32d445011bac57e369c57c85432a0cf7
SHA512

d93aa91b6537cf7e1b1c6081d411487da102bb6f17fe4386ce4fb529780cc4733a5049e4e2cd77e46baeb4f9c1965fe9199d7f7c044e9cba494ad200a0d3d0c3
SSDEEP

6144:4OEqX2Gk6/UgELTlrEFuOuduuuauuuuZfu0KFvH1VczxSw9rrH5BPDOLFUWN3TrR:BEqX2GkEuivHPqPAV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3a577567b80094709c6e0d912bca0af32d445011bac57e369c57c85432a0cf7

Files

c3a577567b80094709c6e0d912bca0af32d445011bac57e369c57c85432a0cf7
.dll regsvr32 windows x86

2cc072cb077c63ad0b29a72b35319f56

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
vDbgPrintExWithPrefix

advapi32

RegCloseKey
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

comctl32

CreatePropertySheetPageA
CreatePropertySheetPageW
DestroyPropertySheetPage
InitCommonControlsEx
PropertySheetW

iphlpapi

GetAdaptersInfo
GetIfEntry
GetIfTable
GetPerAdapterInfo

kernel32

CloseHandle
CreateProcessW
CreateSemaphoreA
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
HeapAlloc
HeapFree
InitializeCriticalSection
IsBadReadPtr
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
_vsnwprintf
_wcsicmp
_winmajor
abort
bsearch
calloc
fputc
fputs
free
fwrite
malloc
memcmp
memcpy
memmove
memset
realloc
sprintf
strchr
strcmp
strcpy
strcspn
strlen
strncmp
swprintf
vfprintf
wcscat
wcscpy
wcslen
_write

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID

setupapi

SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsA

shell32

ILClone
ILFindLastID
SHAlloc
SHCreateShellFolderViewEx
SHFree
Shell_NotifyIconW

shlwapi

SHStrDupW
StrFormatByteSizeW

ws2_32

inet_addr
ntohl

user32

BringWindowToTop
CopyImage
CreateDialogParamW
DestroyIcon
DialogBoxParamW
EnableWindow
EndDialog
GetClientRect
GetDlgItem
GetDlgItemTextW
GetParent
GetWindowLongA
InsertMenuItemW
IsDlgButtonChecked
LoadIconA
LoadImageA
LoadStringW
MessageBoxW
PostMessageA
SendDlgItemMessageA
SendDlgItemMessageW
SendMessageA
SendMessageW
SetDlgItemTextW
SetFocus
SetTimer
SetWindowLongA
ShowWindow

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoInitialCleanup
HrCreateDesktopIcon
HrGetAnswerFileParametersForNetCard
HrGetExtendedStatusFromNCS
HrGetIconFromMediaType
HrGetInstanceGuidOfPreNT5NetCardInstance
HrGetNetConExtendedStatusFromGuid
HrGetNetConExtendedStatusFromINetConnection
HrGetStatusStringFromNetConExtendedStatus
HrIsIpStateCheckingEnabled
HrLaunchConnection
HrLaunchConnectionEx
HrLaunchNetworkOptionalComponents
HrOemUpgrade
HrRenameConnection
HrRunWizard
InvokeDunFile
NcFreeNetconProperties
NcIsValidConnectionName
NetSetupAddRasConnection
NetSetupFinishInstall
NetSetupInstallSoftware
NetSetupPrepareSysPrep
NetSetupRequestWizardPages
NetSetupSetProgressCallback
NormalizeExtendedStatus
RaiseSupportDialog
RepairConnection
StartNCW

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cc072cb077c63ad0b29a72b35319f56

Headers

File Characteristics

Imports

ntdll

advapi32

comctl32

iphlpapi

kernel32

msvcrt

ole32

setupapi

shell32

shlwapi

ws2_32

user32

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 83KB

.data Size: 19KB - Virtual size: 18KB

.rdata Size: 29KB - Virtual size: 29KB

/4 Size: 512B - Virtual size: 500B

.bss Size: - Virtual size: 5KB

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 290KB - Virtual size: 289KB

.reloc Size: 5KB - Virtual size: 4KB

.rossym Size: 126KB - Virtual size: 126KB

.text
Size: 83KB - Virtual size: 83KB

.data
Size: 19KB - Virtual size: 18KB

.rdata
Size: 29KB - Virtual size: 29KB

/4
Size: 512B - Virtual size: 500B

.bss
Size: - Virtual size: 5KB

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 290KB - Virtual size: 289KB

.reloc
Size: 5KB - Virtual size: 4KB

.rossym
Size: 126KB - Virtual size: 126KB