b1ea4a10e84765dab0d8312b143098c2772271e6684d15d602b2653830a41431

Sharing

Copy URL Twitter E-mail

General

Target

b1ea4a10e84765dab0d8312b143098c2772271e6684d15d602b2653830a41431
Size

13.2MB
MD5

c8187ed57aed8b60eb12f0edab0d5e0f
SHA1

424d7e48db193aebb742e153411c11ffeead7eea
SHA256

b1ea4a10e84765dab0d8312b143098c2772271e6684d15d602b2653830a41431
SHA512

096664b9856f306430d191143798947811d40a0fbf7fa45ec812ba645456fb5bbf375d3388a27678234291f50d0dc3992d23b30561e8648eda79f8ff2d0753ba
SSDEEP

196608:dfAx9USY09YzF56jCRia4njDRmPFB79SD++SD+0J9Kq:dpSYnzkiPqaL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1ea4a10e84765dab0d8312b143098c2772271e6684d15d602b2653830a41431

Office document contains embedded OLE objects 1 IoCs

Detected embedded OLE objects in Office documents.

resource	yara_rule
sample	office_ole_embedded

Files

b1ea4a10e84765dab0d8312b143098c2772271e6684d15d602b2653830a41431
.dll windows x86

f1eae7dc0d89aeba767d85b84f4af7aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MoveFileA
GetFileTime
GetDriveTypeA
RemoveDirectoryA
FindFirstFileA
ResumeThread
SuspendThread
CreateThread
GetCurrentDirectoryA
LoadLibraryA
GetVersionExA
DeviceIoControl
lstrlenA
InterlockedIncrement
InterlockedDecrement
GetACP
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
VirtualFree
GetLastError
VirtualAlloc
MultiByteToWideChar
CreateFileA
MapViewOfFile
UnmapViewOfFile
GetFileSizeEx
CreateFileMappingA
CreateFileMappingW
GetModuleHandleA
OutputDebugStringA
CloseHandle
GetFileInformationByHandle
DeleteFileA
LCMapStringA
GetThreadLocale
SetFilePointerEx
ReadFile
WriteFile
SetEndOfFile
GetTempPathA
GetCurrentProcessId
GetCurrentThreadId
IsBadReadPtr
ExpandEnvironmentStringsW
GetFullPathNameW
ExpandEnvironmentStringsA
GetFullPathNameA
GetFileSize
ReleaseMutex
CreateMutexA
Sleep
WaitForSingleObject
GetFileAttributesA
OpenFileMappingA
CreateFileW
GetProcAddress
SetFileAttributesA
GetFileAttributesW
SetFileAttributesW
FlushFileBuffers
SetFilePointer
DeleteFileW
MoveFileExA
MoveFileExW
FindClose
FindFirstFileW
FindNextFileW
FindNextFileA
CreateDirectoryW
FlushViewOfFile
DeleteTimerQueueTimer
CreateEventA
CreateTimerQueueTimer
SearchPathW
GetLongPathNameW
GetSystemDirectoryW
GetSystemDirectoryA
GetWindowsDirectoryA
InterlockedExchange
EncodePointer
DecodePointer
GetStringTypeW
HeapFree
HeapAlloc
GetCommandLineA
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
VirtualProtect
VirtualQuery
RtlUnwind
GetSystemTimeAsFileTime
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
ExitProcess
AreFileApisANSI
HeapSize
GetConsoleMode
ReadConsoleW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetTimeZoneInformation
GetFileAttributesExW
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
LoadLibraryW
FreeLibrary
SetStdHandle
SetEnvironmentVariableA
LocalFree
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
GetSystemInfo
CreateDirectoryA
GetModuleFileNameW
GetTickCount

advapi32

RegOpenKeyExW
RegEnumValueW
RegOpenKeyExA
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyA

rpcrt4

RpcServerListen
RpcStringBindingComposeW
RpcServerUseProtseqEpW
RpcAsyncCompleteCall
RpcAsyncAbortCall
RpcServerUnregisterIf
RpcServerRegisterIf
UuidCreate
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
NdrAsyncClientCall
NdrAsyncServerCall
RpcMgmtStopServerListening
RpcAsyncInitializeHandle
RpcAsyncCancelCall

sfc

SfcIsFileProtected

user32

IsCharAlphaW
IsCharAlphaA
wsprintfW

shell32

SHGetFolderPathW

oleaut32

VarBstrCat
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayDestroy
SysAllocString
SysStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocStringLen

shlwapi

PathFindFileNameW
PathFindExtensionW
PathIsFileSpecW
PathIsUNCW
StrCmpNW
StrCpyW
StrCmpW
StrTrimW

ole32

CoInitializeSecurity
CoUninitialize
CoInitialize
CoCreateInstance

Exports

Exports

LacCancelInvoke
LacCloseRemote
LacCompleteInvoke
LacInvokeAsyn
LacInvokeSync
LacIsValid
LacListen
LacOpenRemote
LacRegisterFunction
LacRevokeFunction
LacSetOutParam
LacSetPublishName
LacShutdown
MSFDecode
MSFEncode
MSPDecode
MSPEncode
MainClassId
MainClassName
MssCleanVfsCache
MssCreateInstance
MssCreateMutexOfFile
MssCreateTableManager
MssCreateTableManagerEx
MssCreateTableManagerExW
MssLoadLibFile
MssLoadLibFile2
MssLoadLibFile2W
MssSetCacheSize
MssSetVfsParam
RApiInit
RECreateInstance
REGetClassObject13
RFileClose
RFileCreateA
RFileCreateW
RFileDeleteByHandle
RFileDeleteByNameA
RFileDeleteByNameW
RFileEnumClose
RFileEnumFirstA
RFileEnumFirstW
RFileEnumNext
RFileFlush
RFileGetSizeEx
RFileRead
RFileSetEnd
RFileSetPointerEx
RFileWrite
RoClearVariant
RoCreateInstance
RoCreateInstanceEx
RoCreateInstanceNCT
RoSetVariant
RxGetRemoteConfig
RxHome
RxHomeW
RxSetHome
ValueCheckType
ValueCheckType2
ValueCheckTypes
ValueClear
ValueClone
ValueFromJson
ValueInit
ValueLoad
ValueSave
ValueSet
ValueSetType
ValueSetType2
ValueToJson
ffrid2fmtid
ffrver
fmtdetail
fmtid2ffrid
fmtid2name
fmtidmax
fmtrec_a
fmtrec_b
fmtrec_s
fmttest
fmttestbit
mask2name
name2fmtid
name2mask
rxfree
rxmalloc
sig64FetchA
sig64FetchF
sig64FetchS

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 820KB - Virtual size: 820KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1eae7dc0d89aeba767d85b84f4af7aa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

rpcrt4

sfc

user32

shell32

oleaut32

shlwapi

ole32

Exports

Exports

Sections

.text Size: 8.1MB - Virtual size: 8.1MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 1.6MB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 820KB - Virtual size: 820KB

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 1.6MB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 820KB - Virtual size: 820KB