51f2dffbcd1bc82ff30315de95d62d4b84773df81b488c48dcc64a69577eb351

Sharing

Copy URL

Twitter E-mail

General

Target

51f2dffbcd1bc82ff30315de95d62d4b84773df81b488c48dcc64a69577eb351
Size

1.2MB
MD5

9fa93f29a2320241ca514949fe275d3c
SHA1

3bedca01a7145c66fc2154818e778dcc708a166f
SHA256

51f2dffbcd1bc82ff30315de95d62d4b84773df81b488c48dcc64a69577eb351
SHA512

a192662d80fbca0bfa59a9d0898b6f80a29c846dbabef299689396abb58e82459d40fee5033c8d3ac11da8208bff24a58d3e8703802ec1d099366016f29700b3
SSDEEP

24576:YsEKgNXNGmk+FwDcHyj9w/Gj0Kw2TItHNt8miokkyohe0m+MkATFYuj0IZi:HU0fH9TbjxZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51f2dffbcd1bc82ff30315de95d62d4b84773df81b488c48dcc64a69577eb351

Files

51f2dffbcd1bc82ff30315de95d62d4b84773df81b488c48dcc64a69577eb351
.dll windows x86

218e2a58e6059790e6575735e899059b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Module32First
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
lstrlenA
lstrcpyA
GetModuleHandleA
GlobalAlloc
GlobalLock
GlobalUnlock
RtlZeroMemory
HeapDestroy
GetLastError
HeapCreate
InterlockedIncrement
InterlockedDecrement
HeapSize
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetFilePointer
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcatA
VirtualProtect
ExitProcess
IsBadReadPtr
GetUserDefaultLCID
GetTickCount
LCMapStringA
GetCommandLineA
GetModuleFileNameA
CreateToolhelp32Snapshot
LoadLibraryA
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
VirtualQueryEx
GetOEMCP
GetACP
GetCPInfo
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetCurrentProcessId
TerminateProcess
OpenProcess
ReadFile
GetFileSizeEx
CreateFileW
CloseHandle
FindClose
FindFirstFileA
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrcmpiW
lstrcmpW
lstrlenW
RtlMoveMemory
GetStdHandle
SetHandleCount
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
RtlUnwind
GetVersion
WriteFile
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
WideCharToMultiByte
FreeLibrary
GetProcAddress
lstrcpynW
IsBadCodePtr
MultiByteToWideChar

user32

PostMessageA
MsgWaitForMultipleObjects
wvsprintfA
SendMessageA
CreateIconFromResource
GetWindowRect
SetForegroundWindow
TrackPopupMenu
GetAsyncKeyState
OpenClipboard
EmptyClipboard
CloseClipboard
SetWindowRgn
GetClipboardData
EnumChildWindows
GetClassNameA
FindWindowA
MoveWindow
DestroyMenu
CreatePopupMenu
GetCursorPos
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SetParent
GetWindowLongA
GetParent
SetWindowLongA
IsMenu
EnableMenuItem
AppendMenuA
SetTimer
CreateWindowExA
MessageBoxA
IsWindow
KillTimer
CharLowerW

gdi32

DeleteObject

advapi32

CryptSetKeyParam
CryptCreateHash
CryptExportKey
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptDestroyKey
CryptAcquireContextA
CryptImportKey
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
CryptHashData

comdlg32

GetOpenFileNameW
GetSaveFileNameA

ole32

CoCreateInstance
CLSIDFromString
CoInitializeEx
CoUninitialize
OleRun
CoInitialize
IsEqualGUID
CLSIDFromProgID

shell32

StrRStrIW
StrStrW
Shell_NotifyIconA
ShellExecuteA
StrCmpNIW
StrRStrW
StrStrIW

shlwapi

StrSpnW
StrToIntW
StrToIntExW
StrToIntExA

wininet

HttpOpenRequestW
InternetOpenW
InternetSetOptionA
InternetCloseHandle
InternetConnectW
HttpSendRequestW
InternetQueryOptionW
HttpQueryInfoW
InternetReadFile
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetSetCookieA
InternetGetCookieA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
HttpAddRequestHeadersW

atl

ord42
ord47

ws2_32

inet_addr
WSACreateEvent
WSAEventSelect
ioctlsocket
htons
setsockopt
WSACloseEvent
shutdown
select
connect
closesocket
WSAStartup
gethostbyname
accept
recv
send
socket
WSACleanup
bind

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

iphlpapi

GetAdaptersInfo

crypt32

CertFreeCertificateContext
CertOpenSystemStoreA
CertFindCertificateInStore
CertVerifyTimeValidity
CertVerifyRevocation
CryptImportPublicKeyInfo
CertCloseStore

oleaut32

LoadTypeLi
SafeArrayDestroy
VariantChangeType
VariantInit
VariantClear
SysAllocString
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys

winhttp

WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSetCredentials
WinHttpOpen

secur32

EncryptMessage
QueryContextAttributesA
AcquireCredentialsHandleA
InitializeSecurityContextA
FreeContextBuffer
DecryptMessage

winmm

PlaySoundA

Exports

Exports

IDx15
IDx16
IDx17
IDx18
IDx19
IDx20
IDx21
IDx22
IDx23
IDx24
IDx25
IDx26
IDx27
IDx28
IDx29
IDx30
IDx31
IDx32
IDx33
IDx34
IDx35
IDx36
IDx37
IDx38
IDx39
IDx40
IDx41
IDx42
IDx43
IDx44
IDx45
IDx46
IDx47
IDx48
IDx49
IDx50
IDx51
IDx52
IDx53
IDx54
IDx55
IDx56
IDx57
IDx58
IDx60
IDx61
IDx62
IDx63
IDx64
IDx65
IDx66
IDx67
IDx68
IDx69
IDx70

Sections

.text
Size: 952KB - Virtual size: 949KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

218e2a58e6059790e6575735e899059b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comdlg32

ole32

shell32

shlwapi

wininet

atl

ws2_32

urlmon

iphlpapi

crypt32

oleaut32

winhttp

secur32

winmm

Exports

Exports

Sections

.text Size: 952KB - Virtual size: 949KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 148KB - Virtual size: 214KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 952KB - Virtual size: 949KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 148KB - Virtual size: 214KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 32KB - Virtual size: 31KB