027853bdc73583b42187ec6ba2cbeadf4c9d48b78253dd07be12a80da028009f

Sharing

Copy URL Twitter E-mail

General

Target

027853bdc73583b42187ec6ba2cbeadf4c9d48b78253dd07be12a80da028009f
Size

1.1MB
MD5

422753926e34865af0bf6ed18c412a3d
SHA1

5bf0ace3486dfa6aa86fa8025c147a77e8a3da7b
SHA256

027853bdc73583b42187ec6ba2cbeadf4c9d48b78253dd07be12a80da028009f
SHA512

163014a076b814cab3c50f9dfa3c6beba9968a1cb7aa6c49f57eb3a9f1916079a21fc3e02c679d365a88f59ed479d015341e22fac11cd5b93a0d8528adfb31f4
SSDEEP

6144:Nf7bF6YJHmVzsIcES3BjJkzqmhtPytcZbHNNNXQigiTF1PxNNNNNNRNN0RhtxOh1:97bF6YJHmVzsITLPytcZbE7yZbWGd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
027853bdc73583b42187ec6ba2cbeadf4c9d48b78253dd07be12a80da028009f

Files

027853bdc73583b42187ec6ba2cbeadf4c9d48b78253dd07be12a80da028009f
.dll windows x86

7b75407bb71ba7e194fcd11f7807a715

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
RtlAllocateHeap
RtlAssert
RtlCreateBootStatusDataFile
RtlFreeHeap
RtlInitUnicodeString
RtlNtStatusToDosError
RtlRaiseException
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize

advapi32

AdjustTokenPrivileges
ChangeServiceConfigW
CloseServiceHandle
ConvertStringSidToSidW
LookupPrivilegeValueW
LsaAddAccountRights
LsaClose
LsaCreateAccount
LsaFreeMemory
LsaOpenPolicy
LsaQueryInformationPolicy
LsaSetInformationPolicy
OpenProcessToken
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSaveKeyExW
RegSetValueExW
StartServiceW

comctl32

CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_AddMasked
ImageList_Create
InitCommonControlsEx
PropertySheetW

kernel32

CloseHandle
CreateDirectoryW
CreateFileW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
EnumResourceNamesW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeW
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalDriveStringsW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetThreadId
GetTickCount
GetWindowsDirectoryW
GlobalAddAtomW
GlobalDeleteAtom
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalFree
LockResource
MoveFileExW
MulDiv
MultiByteToWideChar
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
RtlUnwind
SetComputerNameExW
SetComputerNameW
SetFileAttributesW
SetFilePointer
SetLastError
SetLocalTime
SetTimeZoneInformation
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
WritePrivateProfileStringW
lstrlenW

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_snwprintf
_ultow
_unlock
_vsnwprintf
_wcsicmp
_wtoi
abort
calloc
free
fwrite
isprint
malloc
memmove
rand
srand
strncmp
swprintf
time
vfprintf
vsprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncat
wcsncpy
wcsrchr
wcstoul

ole32

CoCreateInstance
CoInitialize
CoUninitialize

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

samlib

SamCloseHandle
SamConnect
SamFreeMemory
SamOpenDomain
SamOpenUser
SamQueryInformationUser
SamSetInformationDomain
SamSetInformationUser

setupapi

CMP_WaitNoPendingInstallEvents
SetupCloseInfFile
SetupDefaultQueueCallbackW
SetupDiGetDeviceRegistryPropertyW
SetupDiInstallClassW
SetupDiOpenDevRegKey
SetupFindFirstLineW
SetupFindNextLine
SetupGetBinaryField
SetupGetFieldCount
SetupGetIntField
SetupGetLineCountW
SetupGetMultiSzFieldW
SetupGetStringFieldW
SetupInitDefaultQueueCallback
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupOpenInfFileW
SetupTermDefaultQueueCallback
pSetupEnablePrivilege

shell32

Control_RunDLLW
SHGetFolderPathAndSubDirW
SHGetFolderPathW

shlwapi

PathAddBackslashW

userenv

ord155
GetDefaultUserProfileDirectoryW
ord100

gdi32

CreateFontIndirectW
DeleteObject
GetDeviceCaps
SetBkColor
SetTextColor

user32

ChangeDisplaySettingsW
CreateDialogParamW
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableWindow
EndDialog
EnumDisplaySettingsW
ExitWindowsEx
GetDC
GetDesktopWindow
GetDlgItem
GetDlgItemTextW
GetMessageW
GetParent
GetSysColor
GetSysColorBrush
GetWindowLongW
GetWindowRect
IsDialogMessageW
KillTimer
LoadIconW
LoadImageW
LoadStringW
MessageBoxA
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
RegisterHotKey
ReleaseDC
SendDlgItemMessageW
SendMessageA
SendMessageW
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetTimer
SetWindowLongW
SetWindowPos
ShowWindow
TranslateMessage
UnregisterHotKey
wsprintfW

Exports

Exports

AsprRestoreNonCriticalDisksW
AsrAddSifEntryA
AsrAddSifEntryW
AsrCreateStateFileA
AsrCreateStateFileW
AsrFreeContext
AsrRestorePlugPlayRegistryData
AsrpGetLocalDiskInfo
AsrpGetLocalVolumeInfo
CdromPropPageProvider
ComputerClassInstaller
CreateLocalAdminAccount
CreateLocalAdminAccountEx
CreateLocalUserAccount
CriticalDeviceCoInstaller
DevInstallW
DeviceBayClassInstaller
DiskPropPageProvider
DoInstallComponentInfs
EisaUpHalCoInstaller
EisaUpHalPropPageProvider
GenerateName
HdcClassInstaller
InitializeSetupActionLog
InstallWindowsNt
InvokeExternalApplicationEx
KeyboardClassInstaller
LegacyDriverPropPageProvider
MigrateExceptionPackages
MouseClassInstaller
NtApmClassInstaller
OpkCheckVersion
PS2MousePropPageProvider
PnPInitializationThread
PrepareForAudit
RepairStartMenuItems
ReportError
RunOEMExtraTasks
ScsiClassInstaller
SetAccountsDomainSid
SetupAddOrRemoveTestCertificate
SetupChangeFontSize
SetupChangeLocale
SetupChangeLocaleEx
SetupCreateOptionalComponentsPage
SetupDestroyLanguageList
SetupDestroyPhoneList
SetupEnumerateRegisteredOsComponents
SetupExtendPartition
SetupGetGeoOptions
SetupGetKeyboardOptions
SetupGetLocaleOptions
SetupGetProductType
SetupGetSetupInfo
SetupGetValidEula
SetupInfObjectInstallActionW
SetupInstallCatalog
SetupMapTapiToIso
SetupOobeBnk
SetupOobeCleanup
SetupOobeInitDebugLog
SetupOobeInitPostServices
SetupOobeInitPreServices
SetupPidGen3
SetupQueryRegisteredOsComponent
SetupQueryRegisteredOsComponentsOrder
SetupReadPhoneList
SetupSetAdminPassword
SetupSetDisplay
SetupSetIntlOptions
SetupSetRegisteredOsComponentsOrder
SetupSetSetupInfo
SetupShellSettings
SetupStartService
SetupUnregisterOsComponent
StorageCoInstaller
SystemUpdateUserProfileDirectory
TapeClassInstaller
TapePropPageProvider
TerminateSetupActionLog
UpdatePnpDeviceDrivers
UpgradePrinters
ViewSetupActionLog
VolumeClassInstaller
pSetupDebugPrint
pSetuplogSfcError

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 988B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 918KB - Virtual size: 918KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b75407bb71ba7e194fcd11f7807a715

Headers

File Characteristics

Imports

ntdll

advapi32

comctl32

kernel32

msvcrt

ole32

rpcrt4

samlib

setupapi

shell32

shlwapi

userenv

gdi32

user32

Exports

Exports

Sections

.text Size: 61KB - Virtual size: 61KB

.data Size: 512B - Virtual size: 372B

.rdata Size: 22KB - Virtual size: 21KB

/4 Size: 512B - Virtual size: 20B

.bss Size: - Virtual size: 988B

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 918KB - Virtual size: 918KB

.reloc Size: 4KB - Virtual size: 3KB

.rossym Size: 86KB - Virtual size: 86KB

.text
Size: 61KB - Virtual size: 61KB

.data
Size: 512B - Virtual size: 372B

.rdata
Size: 22KB - Virtual size: 21KB

/4
Size: 512B - Virtual size: 20B

.bss
Size: - Virtual size: 988B

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 918KB - Virtual size: 918KB

.reloc
Size: 4KB - Virtual size: 3KB

.rossym
Size: 86KB - Virtual size: 86KB