ed512df72c61248278947b813622bce55c8d76e7ab1f419717c895c79f7cd900

Sharing

Copy URL Twitter E-mail

General

Target

ed512df72c61248278947b813622bce55c8d76e7ab1f419717c895c79f7cd900
Size

949KB
MD5

af857a88494453dd2125167196f1ea4a
SHA1

5b8c3512360ba7f1549b9b51ddc02f6e68519669
SHA256

ed512df72c61248278947b813622bce55c8d76e7ab1f419717c895c79f7cd900
SHA512

3f188a0504aae7c79bf990d0f2185006e42ed768136ad3a50055ba19f67b09195fdabb0522a5cf4a75d45972691330bedaa8fc38463fe499ac7d874d4df94082
SSDEEP

24576:0vj8oE3KrEr/4K65e0NSL0K3t0IlUoNP6k4rmM:qjzbhK65e0YF9V154rX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed512df72c61248278947b813622bce55c8d76e7ab1f419717c895c79f7cd900

Files

ed512df72c61248278947b813622bce55c8d76e7ab1f419717c895c79f7cd900
.dll windows x64

36530002df2abe26683d618a4bbc220a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
WSAStartup

kernel32

RtlUnwind
ExitProcess
GetModuleHandleExW
VirtualProtect
GetModuleHandleA
GetProcAddress
SizeofResource
FreeLibraryAndExitThread
MultiByteToWideChar
Sleep
LockResource
CreateThread
LoadResource
FindResourceW
GetModuleHandleW
GetCurrentProcess
K32GetModuleInformation
OutputDebugStringA
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
FlushInstructionCache
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
CloseHandle
CreateToolhelp32Snapshot
InitializeCriticalSectionAndSpinCount
Thread32Next
VirtualAlloc
VirtualFree
VirtualQuery
GetSystemInfo
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GetProcessHeap
FreeLibrary
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
LoadLibraryW
FormatMessageW
Thread32First
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetTimeZoneInformation
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
GetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
TlsFree

user32

MapVirtualKeyW
GetKeyNameTextA
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
MessageBoxW
FindWindowW
MessageBoxA
SetForegroundWindow
ToAscii
GetClientRect
FindWindowA
SetCursorPos
VkKeyScanExA
LoadKeyboardLayoutA

ole32

CoUninitialize

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetCPInfo
LCMapStringEx
FormatMessageA

api-ms-win-core-file-l1-1-0

CreateFileW
SetFileInformationByHandle
FindFirstFileW
FindFirstFileExW
FindNextFileW
CreateDirectoryW
GetFileAttributesExW
FindClose

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
LeaveCriticalSection

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsGetValue
FlsAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

oleaut32

SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo

Exports

Exports

LatiteGetServerName
LatiteSetIsAppx

Sections

.text
Size: 652KB - Virtual size: 651KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36530002df2abe26683d618a4bbc220a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

ole32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

oleaut32

Exports

Exports

Sections

.text Size: 652KB - Virtual size: 651KB

.rdata Size: 170KB - Virtual size: 169KB

.data Size: 8KB - Virtual size: 22KB

.pdata Size: 26KB - Virtual size: 25KB

_RDATA Size: 1024B - Virtual size: 1024B

.rsrc Size: 86KB - Virtual size: 85KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 652KB - Virtual size: 651KB

.rdata
Size: 170KB - Virtual size: 169KB

.data
Size: 8KB - Virtual size: 22KB

.pdata
Size: 26KB - Virtual size: 25KB

_RDATA
Size: 1024B - Virtual size: 1024B

.rsrc
Size: 86KB - Virtual size: 85KB

.reloc
Size: 5KB - Virtual size: 4KB