31fa2d8405e10a8d63d3b0397e4c38ba9eaf6e79dbbf45cba56ab4f134d0d6ff

Sharing

Copy URL Twitter E-mail

General

Target

31fa2d8405e10a8d63d3b0397e4c38ba9eaf6e79dbbf45cba56ab4f134d0d6ff
Size

1.5MB
MD5

8bebc545ea61d216f28573d5bb2ea12f
SHA1

653ed30c0db7f3b655d81ed74a60ebc2ee4e8a9d
SHA256

31fa2d8405e10a8d63d3b0397e4c38ba9eaf6e79dbbf45cba56ab4f134d0d6ff
SHA512

4e5ee3ca51208f32ad1b9f3f653b7b66d350d456d598f0578ca771212d1795a7a134ac18f8f96bc07368ea09348106797f76a078bdee303f08457599203589e6
SSDEEP

24576:qGBOR8M7IsFCvvgHHDsXylMyT76I5bIeI8UmCMG5OTLpaxcIp5Kgy3:qD8Hvue8z1AOTVaxhly3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31fa2d8405e10a8d63d3b0397e4c38ba9eaf6e79dbbf45cba56ab4f134d0d6ff

Files

31fa2d8405e10a8d63d3b0397e4c38ba9eaf6e79dbbf45cba56ab4f134d0d6ff
.dll windows x86

69eef5f13191d0a042c7635ee4121c14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
lstrcatA
lstrlenA
lstrcpyA
GetTempPathA
DeleteFileA
CreateFileA
GetModuleFileNameA
Sleep
CloseHandle
CreateThread
GetConsoleWindow
SetEndOfFile
GetTimeZoneInformation
IsWow64Process
GetWindowsDirectoryA
QueryPerformanceCounter
GetLastError
QueryPerformanceFrequency
GetThreadTimes
GetCurrentThread
GetSystemTimeAsFileTime
HeapFree
EncodePointer
DecodePointer
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
SetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
GetStdHandle
GetModuleHandleA
GetModuleFileNameW
HeapReAlloc
HeapQueryInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
CreateSemaphoreW
GetFileType
DeleteCriticalSection
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FatalAppExitA
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FlushFileBuffers
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
ReadConsoleW
SetStdHandle
WriteConsoleW
CreateFileW
WriteFile
LoadLibraryA
SetEnvironmentVariableA

user32

MessageBoxA

shlwapi

StrStrIA

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom

Exports

Exports

DllGetClassObject
GetProxyDllInfo
MigrateRegisteredSTIAppsForWIAEvents
MpAddDynamicSignatureFile
MpAllocMemory
MpCleanOpen
MpCleanStart
MpClientUtilExportFunctions
MpConfigClose
MpConfigDelValue
MpConfigGetValue
MpConfigGetValueAlloc
MpConfigInitialize
MpConfigIteratorClose
MpConfigIteratorEnum
MpConfigIteratorOpen
MpConfigOpen
MpConfigSetValue
MpConfigUninitialize
MpDynamicSignatureEnumerate
MpDynamicSignatureOpen
MpFreeMemory
MpHandleClose
MpManagerEnable
MpManagerOpen
MpManagerStatusQuery
MpManagerStatusQueryEx
MpManagerVersionQuery
MpQuarantineRequest
MpRemoveDynamicSignatureFile
MpSampleQuery
MpSampleSubmit
MpScanResult
MpScanStart
MpTelemetryAddToAverageDWORD
MpTelemetryInitialize
MpTelemetrySetDWORD
MpTelemetrySetIfMaxDWORD
MpTelemetryUninitialize
MpTelemetryUpload
MpThreatEnumerate
MpThreatOpen
MpUpdateStart
MpUpdateStartEx
MpUtilsExportFunctions
SelectDeviceDialog2
ServiceCrtMain
StiCreateInstance
StiCreateInstanceW
WDEnable

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69eef5f13191d0a042c7635ee4121c14

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

advapi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 239KB - Virtual size: 238KB

.data Size: 128KB - Virtual size: 206KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 66KB - Virtual size: 65KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 239KB - Virtual size: 238KB

.data
Size: 128KB - Virtual size: 206KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 65KB