0c59978bb98f680050a5884150aadc3832674ac15e1b35270ff0ef3d2a71d6c8

Sharing

Copy URL Twitter E-mail

General

Target

0c59978bb98f680050a5884150aadc3832674ac15e1b35270ff0ef3d2a71d6c8
Size

263KB
MD5

bc6553719ed00bd01e3f90330d9c7d14
SHA1

d763775354366e509c3b4cb064811ac7f1656b5d
SHA256

0c59978bb98f680050a5884150aadc3832674ac15e1b35270ff0ef3d2a71d6c8
SHA512

1fb785ee3f69348bd2643f1355eb5b95a49f06c9e4101b7b4ed066f06800d23d2ca9b117d09a80e339b1b25e9b8136e399f721ab374888749fcdca47c8d680ab
SSDEEP

3072:NuNR0oDe/sy8cN+x/cBW2j+avTpFsNWTylkWaSbi2196Y/mEYZJC5ZlX5ute3MCV:NiR4sHSvDs4TyG7Mv+Y/IZJC7ov

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c59978bb98f680050a5884150aadc3832674ac15e1b35270ff0ef3d2a71d6c8

Files

0c59978bb98f680050a5884150aadc3832674ac15e1b35270ff0ef3d2a71d6c8
.dll windows x86

486d3a83fa0992e429bc2902e8a7d3cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetLastError
GlobalFlags
CloseHandle
GetSystemInfo
GetCurrentProcessId
GetModuleHandleW
WideCharToMultiByte
VirtualQuery
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
CreateEventW
SetEvent
ResetEvent
GetSystemTimeAsFileTime
GetEnvironmentVariableW
RaiseException
WriteConsoleW
HeapSize
CreateFileW
GetCurrentProcess
SetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetConsoleMode
GetConsoleOutputCP
WriteFile
GetFileType
GetStdHandle
SetFilePointerEx
DecodePointer
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
FindNextFileW
GetCommandLineW
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
DeleteCriticalSection
FindResourceW
LoadResource
LockResource
FreeResource
GetCurrentThreadId
TerminateProcess
SizeofResource
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LeaveCriticalSection
IsDebuggerPresent
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
FlushFileBuffers

user32

GetDC
ReleaseDC
MessageBoxW
LoadImageW
GetDesktopWindow
LoadCursorW
LoadIconW
LoadStringW
MonitorFromWindow

gdi32

SelectObject
SetDIBColorTable
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateDIBSection

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateGuid
PropVariantClear

comctl32

ImageList_Destroy
ImageList_Create
ImageList_AddMasked

psapi

GetModuleFileNameExW

gdiplus

GdipGetImageWidth
GdipSetCompositingMode
GdipCreateBitmapFromFile
GdipFree
GdipGetImagePalette
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdipGetImagePixelFormat
GdipDeleteGraphics
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0

ws2_32

WSACleanup

Exports

Exports

HideMessage
ToastInit
ToastMessage

Sections

wMDtk
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

EdXcIC
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Vsswd
Size: 15KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

KfBum
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ngqFQn
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

486d3a83fa0992e429bc2902e8a7d3cf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

comctl32

psapi

gdiplus

ws2_32

Exports

Exports

Sections

wMDtk Size: 175KB - Virtual size: 175KB

EdXcIC Size: 55KB - Virtual size: 55KB

Vsswd Size: 15KB - Virtual size: 18KB

KfBum Size: 3KB - Virtual size: 2KB

ngqFQn Size: 13KB - Virtual size: 13KB

wMDtk
Size: 175KB - Virtual size: 175KB

EdXcIC
Size: 55KB - Virtual size: 55KB

Vsswd
Size: 15KB - Virtual size: 18KB

KfBum
Size: 3KB - Virtual size: 2KB

ngqFQn
Size: 13KB - Virtual size: 13KB