89df645c530bb0324368379bcd629e9596d0b62493733b0e76f43d2fa1a339e5

Sharing

Copy URL Twitter E-mail

General

Target

89df645c530bb0324368379bcd629e9596d0b62493733b0e76f43d2fa1a339e5
Size

2.0MB
MD5

e4e97f71d774f416ab6adf0b9a54dc93
SHA1

192d381eb3e2ed8d60104de8c34cde96215bd9fd
SHA256

89df645c530bb0324368379bcd629e9596d0b62493733b0e76f43d2fa1a339e5
SHA512

dd60b579b2053665b8753d2ec97a28710ce8419abfde2e4fbb0389ac9a0b67fc069b979be624d9f3a1b0debf1c3432323d3fc926e5ffa5bf9311ce127ba2bf1f
SSDEEP

49152:NRhKayfwmZ4kqCXzZJuigT3nkby07T9pcOjDx:NroZ4kVXXuiPyeDzDx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89df645c530bb0324368379bcd629e9596d0b62493733b0e76f43d2fa1a339e5

Files

89df645c530bb0324368379bcd629e9596d0b62493733b0e76f43d2fa1a339e5
.dll windows x86

99e882e925a4d4f823f5b3d29bd34e2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
WSAIoctl
setsockopt
getsockname
ntohs
bind
getsockopt
getpeername
freeaddrinfo
getaddrinfo
connect
htons
closesocket
gethostbyname
socket
recv
send
WSACleanup
ioctlsocket
WSAStartup

kernel32

SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetProcessTimes
WTSGetActiveConsoleSessionId
SleepEx
FreeLibrary
WritePrivateProfileStringW
GetLocalTime
lstrcmpiW
FindFirstFileW
FindClose
TerminateThread
GetSystemDefaultLangID
lstrcpyW
WideCharToMultiByte
SetLastError
GlobalAlloc
GlobalFree
MoveFileW
OpenMutexW
CreateMutexW
GetModuleFileNameW
MoveFileExW
CopyFileW
FindFirstFileA
FindNextFileA
MultiByteToWideChar
FindNextFileW
FlushFileBuffers
WaitForMultipleObjects
GetSystemInfo
GetExitCodeProcess
GetWindowsDirectoryW
FreeResource
LoadLibraryExW
GetSystemWindowsDirectoryW
GetVersionExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
InterlockedDecrement
GlobalMemoryStatusEx
SetFileAttributesW
ReleaseMutex
GetVolumeInformationW
ExitThread
OpenEventW
GetFileTime
SystemTimeToFileTime
VirtualQuery
FlushInstructionCache
VirtualAlloc
VirtualFree
FindResourceW
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
DeviceIoControl
GetCurrentProcessId
SetFilePointer
GetTempPathW
CreateRemoteThread
VirtualProtectEx
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
InterlockedExchange
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
HeapCreate
RtlUnwind
GetCommandLineA
GetStdHandle
GetFileType
WriteConsoleW
UnhandledExceptionFilter
TlsFree
TlsAlloc
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
SetEndOfFile
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeleteFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLastError
FindResourceExW
lstrlenA
LoadLibraryW
lstrlenW
TerminateProcess
VirtualAllocEx
GetFileSize
WriteProcessMemory
GetProcessId
CreateProcessW
GetFileAttributesA
GetSystemDirectoryW
RaiseException
CreateThread
WaitForSingleObject
ExitProcess
ResumeThread
LoadLibraryA
CreateFileA
OpenProcess
CheckRemoteDebuggerPresent
Sleep
GetTickCount
GetSystemTime
GetCurrentProcess
GetModuleHandleW
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
LocalFileTimeToFileTime
lstrcmpiA
lstrcmpA
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
InterlockedCompareExchange
InterlockedIncrement
WriteFile
HeapFree
CloseHandle
ReadFile
GetFileSizeEx
CreateFileW
HeapAlloc
GetProcessHeap
GetDriveTypeA
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
OpenThread

user32

wsprintfW
LoadCursorW
RegisterClassExW
CreateWindowExW
IsWindow
ShowWindow
CreatePopupMenu
AppendMenuW
GetCursorPos
SetForegroundWindow
TrackPopupMenu
PostMessageW
DestroyMenu
DestroyWindow
MessageBoxTimeoutW
DefWindowProcW
GetMessageW
FindWindowW
GetAncestor
WindowFromPoint
PostThreadMessageW
BlockInput
GetWindowRect
GetForegroundWindow
GetShellWindow
GetWindowInfo
TranslateMessage
DispatchMessageW
GetWindowThreadProcessId
LoadImageW
DestroyIcon
PostQuitMessage
GetActiveWindow
MoveWindow
SetWindowPos
MapWindowPoints
UnregisterClassA
GetDesktopWindow
GetWindow
EnumDisplaySettingsW
GetMonitorInfoW
MonitorFromPoint
SendMessageW
ReleaseCapture
SetCapture
PtInRect
ReleaseDC
EndDialog
DialogBoxParamW
InvalidateRect
DrawTextW
GetDC
EndPaint
BeginPaint
SetWindowLongW
SetTimer
GetWindowLongW
MonitorFromWindow
GetParent
GetClientRect

gdi32

CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
TextOutW
DeleteObject
SetTextColor
SelectObject
CreateFontW
SetBkMode
DeleteDC

advapi32

LookupPrivilegeValueW
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegEnumKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegQueryValueExW
CreateProcessAsUserW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegFlushKey
RegCreateKeyExW
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
AdjustTokenPrivileges
RegDeleteValueW
CryptCreateHash

shell32

SHGetFolderPathW
ord165
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathA
Shell_NotifyIconW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CreateStreamOnHGlobal
CoCreateGuid

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime

shlwapi

StrCmpIW
SHGetValueW
PathCombineW
StrStrW
PathAppendA
PathFileExistsA
PathRemoveFileSpecW
SHGetValueA
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathIsDirectoryW
wnsprintfW
StrTrimA
SHSetValueA
PathFindFileNameW
StrCmpNIW
StrCpyW
PathFileExistsW
StrCatW
SHDeleteValueW
SHSetValueW
StrStrIW
PathCombineA

crypt32

CryptStringToBinaryA
CertEnumCertificatesInStore
CertOpenStore
CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CryptBinaryToStringW
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject

setupapi

SetupIterateCabinetW

gdiplus

GdipDrawImageRectRectI
GdipFree
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipAlloc
GdipDisposeImage

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

HttpOpenRequestW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle
HttpAddRequestHeadersW
InternetCrackUrlW
InternetOpenW
InternetConnectW
InternetReadFile

psapi

GetModuleFileNameExW
GetModuleFileNameExA
EnumProcessModules

msimg32

AlphaBlend

netapi32

NetWkstaGetInfo
NetApiBufferFree

Exports

Exports

BrowserLaunch
Do505_Impl
Is360ZipExist
IsBrowserInstalled
IsBrowserInstalled2
IsDesktopLiteExist
IsInDenyPidList
IsNeedInstallSafe
IsPalmInputExist
IsSDExist
IsSafeExist
IsSafeExist2
Report_D5S
SetCurrentModuleInformations
Start
Start360Zip
Start360Zip_UI
StartBrower_UI
StartDesktopLite
StartDesktopLite_UI
StartPalmInput
StartPalmInput_UI
StartSD
StartSD_UI
StartSafe_UI
Start_UI
TestUI
dkeaoaskeugn
do505
do505_ktctl

Sections

.text
Size: 794KB - Virtual size: 793KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99e882e925a4d4f823f5b3d29bd34e2d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

setupapi

gdiplus

version

userenv

wininet

psapi

msimg32

netapi32

Exports

Exports

Sections

.text Size: 794KB - Virtual size: 793KB

.rdata Size: 127KB - Virtual size: 126KB

.data Size: 172KB - Virtual size: 224KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 64KB - Virtual size: 64KB

.text
Size: 794KB - Virtual size: 793KB

.rdata
Size: 127KB - Virtual size: 126KB

.data
Size: 172KB - Virtual size: 224KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 64KB - Virtual size: 64KB