53a3de5bb368be3327cff16aaf6d0ca0d6c5d450fb80d61864ff84f7c9500bf9

Sharing

Copy URL Twitter E-mail

General

Target

53a3de5bb368be3327cff16aaf6d0ca0d6c5d450fb80d61864ff84f7c9500bf9
Size

810KB
MD5

4b8710d9b7fe82fb03f4af49685d26f8
SHA1

dd69a9427dd32992b35b8545da0349d98c8bc651
SHA256

53a3de5bb368be3327cff16aaf6d0ca0d6c5d450fb80d61864ff84f7c9500bf9
SHA512

510a8ecce24f54bb5600c2b1b785d3e1f412984ad7b304b414d987d80888ab9bce1bc81a9e094defea025cdb3bb0481e34e2a0d4c9b25d235363ecbca4066165
SSDEEP

12288:OdwsBl5Wb+TOK+LUt2czxFwbLxtEDD6uo/f/kWstNZ6TlAc+T4x:YBib+TOjUHzOtCD2uw/eDZ6pAJT4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53a3de5bb368be3327cff16aaf6d0ca0d6c5d450fb80d61864ff84f7c9500bf9

Files

53a3de5bb368be3327cff16aaf6d0ca0d6c5d450fb80d61864ff84f7c9500bf9
.dll windows x86

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

LoadStringW
SendMessageW
IsWindow
GetSystemMetrics
MessageBoxW
EnumChildWindows
FindWindowA
FindWindowExA
GetClassNameA
GetWindowThreadProcessId
GetWindowTextA
GetDesktopWindow
FindWindowW
IsCharAlphaA
LoadStringA

msi

ord31
ord70
ord8
ord160
ord50
ord116
ord125
ord118
ord145
ord171
ord159
ord47
ord49
ord74
ord147
ord103
ord17
ord121

shell32

Shell_NotifyIconW

setupapi

InstallHinfSectionW

kernel32

GetFileAttributesExW
SetEndOfFile
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
QueryPerformanceFrequency
VerifyVersionInfoW
GetProductInfo
GetNativeSystemInfo
VerSetConditionMask
GetTickCount
GetLocalTime
GetSystemTime
LoadLibraryExA
VirtualQuery
VirtualProtect
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetDriveTypeA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetModuleHandleA
GetModuleHandleW
GetProcAddress
SizeofResource
FindResourceW
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryW
CreateFileA
GetFileInformationByHandle
ReadFile
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetSystemInfo
GetVersionExA
FreeLibrary
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
RemoveDirectoryW
Sleep
GetCurrentThread
MoveFileExW
FileTimeToLocalFileTime
SetLastError
GetSystemTimeAsFileTime
FormatMessageW
FlushFileBuffers
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
SetEnvironmentVariableW
GetDriveTypeW
GetVolumeInformationW
GetTempPathW
GetSystemDirectoryW
SetCurrentDirectoryW
GetDiskFreeSpaceExW
HeapReAlloc
GetFullPathNameW
SetFileAttributesW
OutputDebugStringA
GetModuleFileNameW
WriteConsoleW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleExW
GetACP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleOutputCP
GetConsoleMode
GetFileType
SetStdHandle
PeekNamedPipe
GetTimeZoneInformation
ExitProcess

Exports

Exports

VMAppSearch
VMAppTerminate
VMAutoSelectInstallDrive
VMCleanupTrayIcons
VMDecoupleChildInstaller
VMDeleteFilesAndFolders
VMDetectRunningVM
VMDetectWin2003R2
VMDisplayWarnings
VMEnterPlayerLicense
VMEnterWorkstationLicense
VMInstallInfKernelDriver
VMInstallKernelDriver
VMIsRepairSafe
VMMessageBox
VMNeedValidLicense
VMReadInProperties
VMRegSvr
VMRemoveRegistryValues64
VMResetRegSecurity
VMServiceFailureConfig
VMSetRealVersionNT
VMSetVMSysVer
VMStopRunningServices
VMUninstallInfKernelDriver
VMUninstallKernelDriver
VMUnregSvr
VMValidateINSTALLDIR
VMValidatePlayerLicense
VMValidateSerialNumber
VMValidateWorkstationLicense
VMWriteRegistryValues64

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

File Characteristics

Imports

user32

msi

shell32

setupapi

kernel32

Exports

Exports

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 177KB - Virtual size: 176KB

.data Size: 51KB - Virtual size: 61KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 177KB - Virtual size: 176KB

.data
Size: 51KB - Virtual size: 61KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 25KB - Virtual size: 24KB