c914f27fc7866b3fe0d2fd19bba4f3405d22ab4364e0b00d075698588ff88779

Sharing

Copy URL Twitter E-mail

General

Target

c914f27fc7866b3fe0d2fd19bba4f3405d22ab4364e0b00d075698588ff88779
Size

2.7MB
MD5

4ceabccb0505b5876177a83315f7f457
SHA1

36ecf8c6763311a3236bc5dcccdc37c3a9f5dc0a
SHA256

c914f27fc7866b3fe0d2fd19bba4f3405d22ab4364e0b00d075698588ff88779
SHA512

e78f8234ec3cb51c57713f0ff5ba1f583cca6156e9def006114020cc850c948a769dc0a39703d13104aa3b2e53ce3a062bfe62cde4695e92682de57fde6d9598
SSDEEP

49152:+C3MAvvGXDc3mIMmyt4D3E11JltJkoWW7prW:o4vCpt4D3Glt9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c914f27fc7866b3fe0d2fd19bba4f3405d22ab4364e0b00d075698588ff88779

Files

c914f27fc7866b3fe0d2fd19bba4f3405d22ab4364e0b00d075698588ff88779
.dll windows x86

528156d0c8e1d7624aa4fd32178ded83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MulDiv
InterlockedDecrement
InterlockedIncrement
SetEnvironmentVariableA
GetFullPathNameA
SetEndOfFile
GetTimeZoneInformation
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
FileTimeToLocalFileTime
WriteConsoleW
GetStringTypeW
OutputDebugStringW
LoadLibraryExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
DeleteFileW
GetFileAttributesExW
CreateDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
OutputDebugStringA
GetFileInformationByHandle
GetFileSizeEx
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsGetValue
TlsSetValue
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
RtlUnwind
EncodePointer
DecodePointer
GetLastError
HeapFree
HeapAlloc
RaiseException
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
HeapReAlloc
IsDebuggerPresent
ReadFile
SetStdHandle
GetFileType
SetLastError
GetCurrentThread
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
SetConsoleCtrlHandler
FatalAppExitA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
GetDriveTypeW

user32

SystemParametersInfoW
GetIconInfo
DrawIconEx
OffsetRect
GetDC
ReleaseDC
InflateRect

gdi32

SelectObject
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GdiFlush
GetTextFaceW
ExtTextOutW
SetWorldTransform
GetTextMetricsW
SetTextAlign
SetTextColor
CreateCompatibleDC
DeleteDC
DeleteObject
ExtCreateRegion
GetRegionData
IntersectClipRect
SelectClipRgn
CreateFontIndirectW
CreateDIBSection
GetObjectW
SetViewportOrgEx
SetGraphicsMode
SetBkMode
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW

utilities

?first_attribute@xml_node@pugi@@QBE?AVxml_attribute@2@XZ
??7xml_node@pugi@@QBE_NXZ
?get_userdata@xml_attribute@pugi@@QBEHXZ
?next_attribute@xml_attribute@pugi@@QBE?AV12@XZ
?value@xml_attribute@pugi@@QBEPB_WXZ
?name@xml_attribute@pugi@@QBEPB_WXZ
??Bxml_attribute@pugi@@QBEP6AXPAPAPAV01@@ZXZ
?CvtW2W@SStrCpCvt@SOUI@@SA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@I@Z
?CvtA2W@SStrCpCvt@SOUI@@SA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV?$TStringT@DUchar_traits@SOUI@@@2@II@Z
?CvtW2A@SStrCpCvt@SOUI@@SA?AV?$TStringT@DUchar_traits@SOUI@@@2@ABV?$TStringT@_WUwchar_traits@SOUI@@@2@I@Z
?Find@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHPB_WH@Z
?Find@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEH_WH@Z
?MakeLower@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV12@XZ
??0?$SObjectImpl@UIObject@SOUI@@@SOUI@@QAE@XZ
?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJABV?$TStringT@DUchar_traits@SOUI@@@2@0H@Z
?Mid@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE?AV12@HH@Z
?CompareNoCase@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHPB_W@Z
?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV01@ABV01@@Z
??1?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@XZ
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@PB_W@Z
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@PB_WH@Z
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@ABV01@@Z
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@XZ
??1?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAE@XZ
??0?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAE@PBD@Z
?AlphaRestore@CGdiAlpha@SOUI@@SAXAAUtagALPHAINFO@2@@Z
?AlphaBackup@CGdiAlpha@SOUI@@SAHPAUHDC__@@PBUtagRECT@@AAUtagALPHAINFO@2@@Z
??0?$SObjectImpl@UIObject@SOUI@@@SOUI@@QAE@ABV01@@Z
?AfterAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0HJ@Z
?DefAttributeProc@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?GetID@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBEHXZ
?GetName@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBEPB_WXZ
?GetObjectClass@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBEPB_WXZ
?GetObjectType@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBEHXZ
?Compare@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHPB_W@Z
?GetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@@Z
?InitFromXml@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEHVxml_node@pugi@@@Z
?IsClass@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UBEHPB_W@Z
?OnInitFinished@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEXVxml_node@pugi@@@Z
?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UAEJPBD0H@Z
??_7IObject@SOUI@@6B@
?Left@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE?AV12@H@Z

ole32

CoCreateGuid

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

opengl32

wglGetCurrentContext
wglGetProcAddress

Exports

Exports

??0?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@QAE@ABV01@@Z
??0?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@QAE@XZ
??0?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@QAE@ABV01@@Z
??0?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@QAE@XZ
??0CCPUUseRate@SOUI@@QAE@ABV01@@Z
??0RenderTarget_Skia2@SOUI@@QAE@ABV01@@Z
??0RenderTarget_Skia2@SOUI@@QAE@XZ
??0SRenderTarget_Skia@SOUI@@QAE@ABV01@@Z
??0SRenderTarget_Skia@SOUI@@QAE@PAUIRenderFactory@1@HH@Z
??1?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@UAE@XZ
??1?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@UAE@XZ
??1CCPUUseRate@SOUI@@AAE@XZ
??1RenderTarget_Skia2@SOUI@@UAE@XZ
??1SRenderTarget_Skia@SOUI@@UAE@XZ
??4?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@QAEAAV01@ABV01@@Z
??4?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@QAEAAV01@ABV01@@Z
??4CCPUUseRate@SOUI@@QAEAAV01@ABV01@@Z
??4RenderTarget_Skia2@SOUI@@QAEAAV01@ABV01@@Z
??4SRenderTarget_Skia@SOUI@@QAEAAV01@ABV01@@Z
??_7?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@6B?$SObjectImpl@UIObject@SOUI@@@1@@
??_7?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@6BIObjRef@@@
??_7?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@6B@
??_7RenderTarget_Skia2@SOUI@@6B@
??_7SRenderTarget_Skia@SOUI@@6B?$SObjectImpl@UIObject@SOUI@@@1@@
??_7SRenderTarget_Skia@SOUI@@6BIObjRef@@@
?AddRef@?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@UAEJXZ
?AddRef@?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@UAEJXZ
?AlphaBlend@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PAUIRenderTarget@2@0E@Z
?BitBlt@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PAUIRenderTarget@2@HHK@Z
?ClearRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@K@Z
?CreateBitmapBrush@SRenderTarget_Skia@SOUI@@UAEJPAUIBitmap@2@PAPAUIBrush@2@@Z
?CreateCompatibleRenderTarget@SRenderTarget_Skia@SOUI@@UAEJUtagSIZE@@PAPAUIRenderTarget@2@@Z
?CreatePen@SRenderTarget_Skia@SOUI@@UAEJHKHPAPAUIPen@2@@Z
?CreateRegion@SRenderTarget_Skia@SOUI@@UAEJPAPAUIRegion@2@@Z
?CreateSolidColorBrush@SRenderTarget_Skia@SOUI@@UAEJKPAPAUIBrush@2@@Z
?DrawArc@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@MM_N@Z
?DrawBitmap9Patch@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PAUIBitmap@2@00IE@Z
?DrawBitmap@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PAUIBitmap@2@HHE@Z
?DrawBitmapEx@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PAUIBitmap@2@0IE@Z
?DrawBitmapTest@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PAUIBitmap@2@HHE@Z
?DrawEllipse@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?DrawIconEx@SRenderTarget_Skia@SOUI@@UAEJHHPAUHICON__@@HHI@Z
?DrawLines@SRenderTarget_Skia@SOUI@@UAEJPAUtagPOINT@@I@Z
?DrawRectangle@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?DrawRoundRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@UtagPOINT@@@Z
?DrawTextW@SRenderTarget_Skia@SOUI@@UAEJPB_WHPAUtagRECT@@I@Z
?ExcludeClipRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?FillArc@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@MM@Z
?FillEllipse@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?FillRectangle@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?FillRoundRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@UtagPOINT@@@Z
?FillSolidEllipse@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@K@Z
?FillSolidRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@K@Z
?FillSolidRoundRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@UtagPOINT@@K@Z
?GetAttribute@SRenderTarget_Skia@SOUI@@UBE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@@Z
?GetCanvas@SRenderTarget_Skia@SOUI@@QAEPAVSkCanvas@@XZ
?GetClipBox@SRenderTarget_Skia@SOUI@@UAEJPAUtagRECT@@@Z
?GetClipRegion@SRenderTarget_Skia@SOUI@@UAEJPAPAUIRegion@2@@Z
?GetCpuUse@CCPUUseRate@SOUI@@QAEXAA_K0@Z
?GetCurrentObject@SRenderTarget_Skia@SOUI@@UAEPAUIRenderObj@2@W4OBJTYPE@2@@Z
?GetDC@SRenderTarget_Skia@SOUI@@UAEPAUHDC__@@I@Z
?GetPixel@SRenderTarget_Skia@SOUI@@UAEKHH@Z
?GetRenderTarget@RenderTarget_Skia2@SOUI@@UAEPAUIRenderTarget@2@XZ
?GetTextColor@SRenderTarget_Skia@SOUI@@UAEKXZ
?GetTransform@SRenderTarget_Skia@SOUI@@UBEJPAUIxForm@2@@Z
?GetViewportOrg@SRenderTarget_Skia@SOUI@@UAEJPAUtagPOINT@@@Z
?GradientFill2@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@W4GradientType@2@KKKMMMHE@Z
?GradientFill@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@HKKE@Z
?GradientFillEx@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@PBUtagPOINT@@PAKPAMHE@Z
?Init@RenderTarget_Skia2@SOUI@@UAEJPAUIRenderTarget@2@@Z
?IntersectClipRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?InvertRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@@Z
?IsFirstRun@CCPUUseRate@SOUI@@ABE_NXZ
?MeasureText@SRenderTarget_Skia@SOUI@@UAEJPB_WHPAUtagSIZE@@@Z
?OffsetViewportOrg@SRenderTarget_Skia@SOUI@@UAEJHHPAUtagPOINT@@@Z
?OnFinalRelease@?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@UAEXXZ
?OnFinalRelease@?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@UAEXXZ
?PopClip@SRenderTarget_Skia@SOUI@@UAEJXZ
?PushClipRect@SRenderTarget_Skia@SOUI@@UAEJPBUtagRECT@@I@Z
?PushClipRegion@SRenderTarget_Skia@SOUI@@UAEJPAUIRegion@2@I@Z
?QueryInterface@SRenderTarget_Skia@SOUI@@UAEJABU_GUID@@PAPAUIObjRef@@@Z
?Release@?$TObjRefImpl@UIRenderTarget@SOUI@@@SOUI@@UAEJXZ
?Release@?$TObjRefImpl@UIRenderTarget_Skia2@SOUI@@@SOUI@@UAEJXZ
?ReleaseDC@SRenderTarget_Skia@SOUI@@UAEXPAUHDC__@@@Z
?Resize@SRenderTarget_Skia@SOUI@@UAEJUtagSIZE@@@Z
?RestoreClip@SRenderTarget_Skia@SOUI@@UAEJH@Z
?SaveClip@SRenderTarget_Skia@SOUI@@UAEJPAH@Z
?SelectDefaultObject@SRenderTarget_Skia@SOUI@@UAEJW4OBJTYPE@2@PAPAUIRenderObj@2@@Z
?SelectObject@SRenderTarget_Skia@SOUI@@UAEJPAUIRenderObj@2@PAPAU32@@Z
?SetAttribute@SRenderTarget_Skia@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?SetCurFrames@CCPUUseRate@SOUI@@QAEXAA_J@Z
?SetPixel@SRenderTarget_Skia@SOUI@@UAEKHHK@Z
?SetProCpu@CCPUUseRate@SOUI@@AAEXAA_K@Z
?SetTextColor@SRenderTarget_Skia@SOUI@@UAEKK@Z
?SetThreadCpu@CCPUUseRate@SOUI@@AAEXAA_K@Z
?SetTransform@SRenderTarget_Skia@SOUI@@UAEJPBUIxForm@2@PAU32@@Z
?SetViewportOrg@SRenderTarget_Skia@SOUI@@UAEJUtagPOINT@@@Z
?TextOutW@SRenderTarget_Skia@SOUI@@UAEJHHPB_WH@Z
?rotate@RenderTarget_Skia2@SOUI@@UAEJM@Z
?scale@RenderTarget_Skia2@SOUI@@UAEJMM@Z
?skew@RenderTarget_Skia2@SOUI@@UAEJMM@Z
?translate@RenderTarget_Skia2@SOUI@@UAEJMM@Z
SCreateInstance

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 419KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

528156d0c8e1d7624aa4fd32178ded83

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

utilities

ole32

usp10

opengl32

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 419KB - Virtual size: 419KB

.data Size: 43KB - Virtual size: 72KB

.tls Size: 512B - Virtual size: 2B

_RDATA Size: 512B - Virtual size: 288B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 98KB - Virtual size: 97KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 419KB - Virtual size: 419KB

.data
Size: 43KB - Virtual size: 72KB

.tls
Size: 512B - Virtual size: 2B

_RDATA
Size: 512B - Virtual size: 288B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 98KB - Virtual size: 97KB