547e7126702384500e01a270be00bed2a84807d6cc2ccb935f0509b8ee18dcb4

Sharing

Copy URL

Twitter E-mail

General

Target

547e7126702384500e01a270be00bed2a84807d6cc2ccb935f0509b8ee18dcb4
Size

3.8MB
MD5

582b2f3f6128dec9cdbe39b08d42afd8
SHA1

729aed3a20a88992f4ca8ee7a65e56ac6feebcef
SHA256

547e7126702384500e01a270be00bed2a84807d6cc2ccb935f0509b8ee18dcb4
SHA512

e775d8b0283a3340c40d7ac0272e604b4a4c967d8a3729599133834097486d176f15955badf0c8882ae93ccf7555c7e46012391558873b31b39f71b4ca0fe437
SSDEEP

98304:e+Hho+ryqZhntdtyijtvXRUQ85cSdiGMX:k+eqDntdFjtvX+Q8VkG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
547e7126702384500e01a270be00bed2a84807d6cc2ccb935f0509b8ee18dcb4

Files

547e7126702384500e01a270be00bed2a84807d6cc2ccb935f0509b8ee18dcb4
.dll windows x86

2c05490bb511bf981d3d7bcb81f861c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
VirtualProtectEx
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
ReadFile
GetModuleFileNameA
SizeofResource
lstrlenW
WriteFile
TerminateProcess
FatalExit
FindResourceA
FindClose
lstrcatA
GetModuleHandleA
GetVersion
MultiByteToWideChar
CopyFileA
GetLastError
CreateFileA
GetSystemDirectoryA
LoadLibraryA
ResumeThread
WritePrivateProfileStringA
LoadLibraryW
LoadResource
SetFileAttributesA
ExitProcess
GetProcessHeap
WideCharToMultiByte
GetPrivateProfileStringA
lstrcmpW
DecodePointer
WriteConsoleW
SetEndOfFile
HeapSize
ReadConsoleW
SetStdHandle
FlushFileBuffers
CreateFileW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
GetFileType
GetStdHandle
SuspendThread
GetCurrentThreadId
Thread32Next
Thread32First
GetCurrentProcess
HeapFree
HeapCreate
VirtualQuery
VirtualAlloc
VirtualFree
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
InterlockedFlushSList
RaiseException
RtlUnwind
GetComputerNameA
IsBadReadPtr
GetSystemTime
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
GetSystemInfo
GetUserDefaultLCID
GetVolumeInformationA
GetDriveTypeA
DeviceIoControl
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

wsprintfA
MessageBoxA
GetShellWindow
wsprintfW

ntdll

NtCreateThreadEx
NtOpenProcess
NtTerminateProcess
NtQuerySystemInformation
NtClose
NtSetContextThread

shlwapi

StrStrW
StrToIntExW
StrToIntA

ws2_32

connect
socket
send
recv
htons
WSACleanup
closesocket
WSAStartup
inet_addr

ole32

CoCreateGuid
CoInitialize

Exports

Exports

ADVANCEDSETUPDIALOG
AbortPrinter
AddFormA
AddFormW
AddJobA
AddJobW
AddMonitorA
AddMonitorW
AddPortA
AddPortExA
AddPortExW
AddPortW
AddPrintProcessorA
AddPrintProcessorW
AddPrintProvidorA
AddPrintProvidorW
AddPrinterA
AddPrinterConnectionA
AddPrinterConnectionW
AddPrinterDriverA
AddPrinterDriverExA
AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
AdvancedDocumentPropertiesA
AdvancedDocumentPropertiesW
AdvancedSetupDialog
ClosePrinter
CloseSpoolFileHandle
CommitSpoolData
ConfigurePortA
ConfigurePortW
ConnectToPrinterDlg
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
CreatePrinterIC
DEVICECAPABILITIES
DEVICEMODE
DeleteFormA
DeleteFormW
DeleteMonitorA
DeleteMonitorW
DeletePortA
DeletePortW
DeletePrintProcessorA
DeletePrintProcessorW
DeletePrintProvidorA
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionA
DeletePrinterConnectionW
DeletePrinterDataA
DeletePrinterDataExA
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverA
DeletePrinterDriverExA
DeletePrinterDriverExW
DeletePrinterDriverW
DeletePrinterIC
DeletePrinterKeyA
DeletePrinterKeyW
DevQueryPrint
DevQueryPrintEx
DeviceCapabilities
DeviceCapabilitiesA
DeviceCapabilitiesW
DeviceMode
DevicePropertySheets
DocumentEvent
DocumentPropertiesA
DocumentPropertiesW
DocumentPropertySheets
EXTDEVICEMODE
EndDocPrinter
EndPagePrinter
EnumFormsA
EnumFormsW
EnumJobsA
EnumJobsW
EnumMonitorsA
EnumMonitorsW
EnumPortsA
EnumPortsW
EnumPrintProcessorDatatypesA
EnumPrintProcessorDatatypesW
EnumPrintProcessorsA
EnumPrintProcessorsW
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversA
EnumPrinterDriversW
EnumPrinterKeyA
EnumPrinterKeyW
EnumPrintersA
EnumPrintersW
ExtDeviceMode
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FlushPrinter
FreePrinterNotifyInfo
GetDefaultPrinterA
GetDefaultPrinterW
GetFormA
GetFormW
GetJobA
GetJobW
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetPrinterDriverDirectoryW
GetPrinterDriverW
GetPrinterW
GetSpoolFileHandle
IsValidDevmodeA
IsValidDevmodeW
OpenPrinterA
OpenPrinterW
PerfClose
PerfCollect
PerfOpen
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
PrinterMessageBoxW
PrinterProperties
QueryColorProfile
QueryRemoteFonts
QuerySpoolMode
ReadPrinter
ResetPrinterA
ResetPrinterW
ScheduleJob
SeekPrinter
SetAllocFailCount
SetDefaultPrinterA
SetDefaultPrinterW
SetFormA
SetFormW
SetJobA
SetJobW
SetPortA
SetPortW
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
SetPrinterDataExW
SetPrinterDataW
SetPrinterW
SplDriverUnloadComplete
SpoolerDevQueryPrintW
SpoolerInit
SpoolerPrinterEvent
StartDocDlgA
StartDocDlgW
StartDocPrinterA
StartDocPrinterW
StartPagePrinter
WaitForPrinterChange
Woool996
WritePrinter
XcvDataW

Sections

.text
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.5S^
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 791KB - Virtual size: 790KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c05490bb511bf981d3d7bcb81f861c5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ntdll

shlwapi

ws2_32

ole32

Exports

Exports

Sections

.text Size: 209KB - Virtual size: 208KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 3KB - Virtual size: 6KB

.5S^ Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 6KB - Virtual size: 6KB

.rsrc Size: 791KB - Virtual size: 790KB

.text
Size: 209KB - Virtual size: 208KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 3KB - Virtual size: 6KB

.5S^
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 791KB - Virtual size: 790KB