6ca267a0acc7465105b0f8a873aeae2b82d7124c583d3044764c0ded39cce77a

Sharing

Copy URL Twitter E-mail

General

Target

6ca267a0acc7465105b0f8a873aeae2b82d7124c583d3044764c0ded39cce77a
Size

892KB
MD5

fba38aa249ad7b3346260493a062b36f
SHA1

7abf72c4ea1b2956f2d35f5a35a8d940084ee373
SHA256

6ca267a0acc7465105b0f8a873aeae2b82d7124c583d3044764c0ded39cce77a
SHA512

a951da6dcdbae3f0165d05861fedccaf23840968db5d351add5b1423175e1a0354a8cf9d63948542016e4c2097c6132aafe12c3376e40b222e9d6cc13f9bcfe1
SSDEEP

12288:Lqfqi3C1vTvK4LEAILMoJvxhiqhMOqFzlahL1yo6iSjyWi:LTi3C1rvK4LEAIRMHFchLai

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ca267a0acc7465105b0f8a873aeae2b82d7124c583d3044764c0ded39cce77a

Files

6ca267a0acc7465105b0f8a873aeae2b82d7124c583d3044764c0ded39cce77a
.dll regsvr32 windows x86

5ae5d77a6056bddad1e6a44a49fd37b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
GetDriveTypeW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersionExW
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryW
ResolveDelayLoadedAPI
RtlUnwind
SetFilePointerEx
SizeofResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
lstrcmpiW

ntdll

RtlIpv6AddressToStringExW
RtlIpv6StringToAddressW
_vsnprintf

ole32

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoMarshalInterface
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUnmarshalInterface
CreateBindCtx
CreateGenericComposite
CreateStreamOnHGlobal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
MkParseDisplayName
ReleaseStgMedium
STGMEDIUM_UserFree
STGMEDIUM_UserMarshal
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
StringFromCLSID

oleaut32

BSTR_UserFree
BSTR_UserMarshal
BSTR_UserSize
BSTR_UserUnmarshal
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConformantStringBufferSize
NdrConformantStringMarshall
NdrConformantStringUnmarshall
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConformantStructUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrSimpleTypeMarshall
NdrSimpleTypeUnmarshall
NdrStubGetBuffer
NdrStubInitialize
NdrUserMarshalBufferSize
NdrUserMarshalMarshall
NdrUserMarshalUnmarshall
RpcRaiseException

shell32

ShellExecuteExW

shlwapi

ord2
PathCreateFromUrlW
PathFindExtensionW
StrChrW
StrCmpNIW
StrCmpNW
UrlCanonicalizeW
UrlCombineW
UrlCompareW
UrlGetPartW
UrlUnescapeW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_strdup
_wcsicmp
_wcsnicmp
free
fwrite
getenv
iswalpha
iswcntrl
iswspace
iswupper
memcmp
memcpy
memmove
memset
strchr
strcmp
strcpy
strcspn
strlen
towlower
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcstol

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableWindow
EndDialog
GetDlgItem
GetPropW
KillTimer
LoadIconW
LoadStringW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
RegisterClassExW
RegisterClipboardFormatW
SendDlgItemMessageW
SetDlgItemTextW
SetPropW
SetTimer
TranslateMessage
UnregisterClassW
wsprintfW

wininet

CommitUrlCacheEntryW
CreateUrlCacheEntryW
FtpGetFileSize
HttpEndRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetErrorDlg
InternetLockRequestFile
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
InternetUnlockRequestFile
InternetWriteFile

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIUriPriv
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IEInstallScope
IsAsyncMoniker
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldShowIntranetWarningSecband
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 232B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ae5d77a6056bddad1e6a44a49fd37b2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

ucrtbase

user32

wininet

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 359KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 80KB - Virtual size: 78KB

.eh_fram Size: 64KB - Virtual size: 61KB

.bss Size: - Virtual size: 232B

.edata Size: 68KB - Virtual size: 65KB

.idata Size: 12KB - Virtual size: 8KB

.rsrc Size: 60KB - Virtual size: 57KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 360KB - Virtual size: 359KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 80KB - Virtual size: 78KB

.eh_fram
Size: 64KB - Virtual size: 61KB

.bss
Size: - Virtual size: 232B

.edata
Size: 68KB - Virtual size: 65KB

.idata
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 60KB - Virtual size: 57KB

.reloc
Size: 20KB - Virtual size: 17KB