47c1ce0bd259f5a86559d73990b59cacc9fff1589e2d2cd8fe5104a587d7421a

Sharing

Copy URL Twitter E-mail

General

Target

47c1ce0bd259f5a86559d73990b59cacc9fff1589e2d2cd8fe5104a587d7421a
Size

134KB
MD5

948994b263b631dd3cdefab1e07abce8
SHA1

fe5b3c546f2b53fb75d82081f314db6f10331580
SHA256

47c1ce0bd259f5a86559d73990b59cacc9fff1589e2d2cd8fe5104a587d7421a
SHA512

b76d1e2ae58bf68d6067d7df193ee046cd1a94a5cc2f32e9e208b705cd3c79237aad4776a500bd3715c96e08b10ee9f85fa960e96dccf731a99aec11e995f2b3
SSDEEP

3072:06FcklpRW2L9DeFd9u+H9v/hoq0kNia4aJMAaL4eDjr101r:0AlpRD5qv4+H9HW9RvDjZ0F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47c1ce0bd259f5a86559d73990b59cacc9fff1589e2d2cd8fe5104a587d7421a

Files

47c1ce0bd259f5a86559d73990b59cacc9fff1589e2d2cd8fe5104a587d7421a
.dll windows x86

e673fde1673575c99980ae745b2fdb15

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc140u

ord2458
ord5921
ord285
ord3009
ord2899
ord14678
ord12429
ord11972
ord1449
ord973
ord1450
ord974
ord2886
ord5586
ord5583
ord8177
ord4735
ord4715
ord1144
ord503
ord3849
ord1511
ord12559
ord4323
ord5109
ord6956
ord1689
ord8360
ord14410
ord14416
ord8712
ord4664
ord12763
ord2990
ord2383
ord13257
ord280
ord2246
ord4834
ord1692
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord12542
ord14589
ord7922
ord14595
ord9398
ord4152
ord4090
ord12947
ord7941
ord2034
ord11982
ord5110
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord286
ord1045
ord8217
ord10433
ord2399
ord2300
ord12251
ord12219
ord12928
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord6860
ord1523
ord2885
ord2385
ord2389
ord1525
ord4799
ord14606
ord11962
ord1142
ord500
ord7997
ord1472
ord2996
ord995
ord7653
ord2304
ord266
ord13258
ord514
ord1151
ord265
ord3174
ord12494
ord11983
ord4815
ord296
ord1514
ord325
ord1053
ord2365
ord324
ord1052
ord2408
ord2411
ord2376
ord2410
ord485
ord2268
ord2374
ord2184
ord1513

kernel32

MoveFileExW
GetModuleHandleW
GetCurrentProcess
CreateDirectoryW
GetSystemWindowsDirectoryW
DeleteFileW
lstrlenW
CreateFileW
DeviceIoControl
WriteFile
CloseHandle
GetShortPathNameW
CreateProcessW
Beep
GetCurrentThread
SetLastError
lstrcmpW
FormatMessageW
lstrcpyW
lstrcatW
MoveFileW
GetUserDefaultUILanguage
GlobalAlloc
GlobalFree
SetEvent
CreateEventW
ResumeThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
VerSetConditionMask
VerifyVersionInfoW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
CopyFileW
GetSystemDirectoryW
WritePrivateProfileStringW
GetPrivateProfileStringW
FreeLibrary
GetProcAddress
WaitForSingleObject
CreateThread
GetModuleFileNameW
OutputDebugStringW
HeapFree
GetProcessHeap
HeapAlloc
Sleep
LocalFree
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
SetUnhandledExceptionFilter
LocalAlloc
GetVersionExW
GetLastError
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead

user32

TranslateMessage
SetForegroundWindow
KillTimer
DispatchMessageW
SetTimer
SendMessageTimeoutW
OpenInputDesktop
SetThreadDesktop
GetMessageW
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
FindWindowW
keybd_event

gdi32

DeleteDC
ExtEscape
CreateDCW

winspool.drv

AddMonitorW
OpenPrinterW
EnumMonitorsW
XcvDataW
ClosePrinter
GetPrinterDriverDirectoryW
AddPrinterDriverW
AddPrinterW
DeletePrinterDriverW
DeletePrinter
ord204
GetPrinterW
EnumJobsW
DocumentPropertiesW
SetPrinterW
DeleteMonitorW
SetJobW

advapi32

GetSecurityDescriptorSacl
GetSecurityDescriptorControl
SetSecurityDescriptorControl
MakeAbsoluteSD
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameW
IsValidSid
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegCreateKeyExW
RegOpenKeyExW
RegSetKeySecurity
FreeSid
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
AddAce
SetFileSecurityW
RegEnumKeyExW
RegCreateKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
StartServiceW
ControlService
DeleteService
CreateServiceW
RegEnumValueW
QueryServiceStatus
ChangeServiceConfigW
RevertToSelf
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
LookupAccountSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
LookupPrivilegeValueW
MakeSelfRelativeSD
RegDeleteKeyW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetThreadToken
ImpersonateSelf
OpenThreadToken
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
GetSecurityDescriptorLength

shlwapi

PathFileExistsW

ole32

StringFromCLSID
CoTaskMemFree

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupDiBuildClassInfoList
SetupDiOpenClassRegKey
SetupDiGetClassDescriptionW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetFieldCount
SetupFindNextLine
SetupOpenInfFileW
SetupDiGetINFClassW
SetupGetStringFieldW
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiClassGuidsFromNameW
SetupDiGetClassDevsW

userenv

UnloadUserProfile

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
_purecall
memmove
wcsstr
__std_terminate
memset
wcsrchr
memcpy

api-ms-win-crt-string-l1-1-0

wcsncpy
wcscpy_s
_wcsupr
_wcsicmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vswprintf_s
__acrt_iob_func
__stdio_common_vswprintf
__stdio_common_vfwprintf

api-ms-win-crt-time-l1-1-0

_localtime64_s
wcsftime
_time64

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_errno
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_resetstkoflw

api-ms-win-crt-math-l1-1-0

_except1

Exports

Exports

ConfigPrinter
InstallDeviceFilter
InstallFileFilter
InstallHookDisp
InstallMirrDisp
InstallNdis
InstallPrinter
InstallPrinterSharePort
StartMirror2
StopMirror2
UnInstallDeviceFilter
UnInstallFileFilter
UnInstallHookDisp
UnInstallMirrDisp
UnInstallNdis
UnInstallPrinter
UnInstallPrinterSharePort

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e673fde1673575c99980ae745b2fdb15

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

ole32

newdev

setupapi

userenv

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 78KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 1024B - Virtual size: 2KB

.gfids Size: 512B - Virtual size: 56B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 79KB - Virtual size: 78KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 1024B - Virtual size: 2KB

.gfids
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB