55a091701ee032d2566ddaf8245416f502fdef4417d0af122f05c2e5e1e258b8

Sharing

Copy URL Twitter E-mail

General

Target

55a091701ee032d2566ddaf8245416f502fdef4417d0af122f05c2e5e1e258b8
Size

3.3MB
MD5

3ccb7cb216200d75ab6f52de967c1d5e
SHA1

ff311b84d0bea7eaa0529cd63790e57fae4caef1
SHA256

55a091701ee032d2566ddaf8245416f502fdef4417d0af122f05c2e5e1e258b8
SHA512

9201ec918e1229cb5666d2db49c1b2aa573a7ceb51707a50bf573c1735537d07e94753fcef44681bd7d3b3a49c6335af9c787d1325fc3c07064eb3f129c1fce6
SSDEEP

49152:K6f67CZvQvin+CxCKRCYN8mFkZ0FTyHi6zjHuj6y2ZlzFPgU6ZZR/CzYKg2c:K6fACZvQY+u3kZ0FeH9zKvqkU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
55a091701ee032d2566ddaf8245416f502fdef4417d0af122f05c2e5e1e258b8

Files

55a091701ee032d2566ddaf8245416f502fdef4417d0af122f05c2e5e1e258b8
.dll regsvr32 windows x86

7be6e6ff811aefdf2964ede484ddb53d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

setsockopt
listen
connect
closesocket
bind
accept
send
recv
WSASetLastError
getservbyname
getservbyport
socket
inet_ntoa
inet_addr
htons
htonl
WSAGetLastError
gethostbyname
ntohs
getsockopt
getsockname
ioctlsocket
select
gethostbyaddr
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
__WSAFDIsSet
inet_pton
WSAIoctl
getpeername
WSASetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSACleanup
shutdown
WSAStartup

kernel32

EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageA
GetCurrentThreadId
GetTickCount
VerSetConditionMask
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
CreateWaitableTimerW
QueueUserAPC
TerminateThread
VerifyVersionInfoW
GetStdHandle
CreateDirectoryW
WriteFile
GetCurrentProcessId
PostQueuedCompletionStatus
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FormatMessageW
GetModuleHandleA
QueryPerformanceFrequency
InitializeCriticalSectionEx
SystemTimeToFileTime
GetSystemTime
ConvertThreadToFiberEx
ConvertFiberToThread
ReadConsoleW
ReadConsoleA
SetConsoleMode
CreateFiberEx
DeleteFiber
SwitchToFiber
GetACP
GetEnvironmentVariableW
GetFileType
SetFilePointer
VirtualFree
Sleep
LocalFree
GetCurrentProcess
CreateProcessW
TerminateProcess
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
CompareFileTime
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetProcessHeap
HeapSize
CreateFileA
PeekNamedPipe
GetEnvironmentVariableA
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
MoveFileExA
GetTimeZoneInformation
InitOnceBeginInitialize
InitOnceComplete
IsDebuggerPresent
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
LoadLibraryA
GetSystemDirectoryA
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
ReadFile
GetFileSizeEx
CreateFileW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
CopyFileW
DeleteFileW
CreateThread
InitializeSListHead

user32

TranslateMessage
GetMessageW
PostMessageW
GetProcessWindowStation
SetWindowLongW
MessageBoxW
GetUserObjectInformationW
GetWindowLongW
KillTimer
SetTimer
DestroyWindow
CreateWindowExW
RegisterClassExW
DispatchMessageW
DefWindowProcW

shell32

ord165

ole32

CoUninitialize
CoInitialize

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptAcquireContextA
CryptGetHashParam
CryptHashData
CryptGenRandom
CryptReleaseContext

msvcp140

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Xtime_get_ticks
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Thrd_detach
_Query_perf_frequency
_Query_perf_counter
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??Bid@locale@std@@QAEIXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Xbad_alloc@std@@YAXXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
_Mtx_lock

shlwapi

PathAddBackslashW
PathRemoveFileSpecW
PathIsRelativeW
PathFileExistsW
PathAppendW
PathCanonicalizeW
PathQuoteSpacesW
PathFindFileNameW

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
__current_exception_context
__current_exception
_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
memchr
__std_type_info_compare
wcsstr
wcschr
strstr
strrchr
strchr
memset
memmove
__CxxFrameHandler3
_CxxThrowException
memcpy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
__sys_errlist
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
raise
_exit
terminate
signal
_getpid
strerror_s
__sys_nerr
_wassert
abort
_errno
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh
realloc
_recalloc

api-ms-win-crt-convert-l1-1-0

strtoll
wcstod
_wtoi
_ecvt_s
wcstombs
strtol
atoi
strtoul

api-ms-win-crt-string-l1-1-0

strcmp
_strdup
tolower
strcspn
strspn
isdigit
isupper
strncpy
wcscspn
strncpy_s
wcsncpy
strcat_s
wcsncat
wcsspn
wmemcpy_s
strcpy_s
isspace
strpbrk
strnlen
strncmp
wcsnlen

api-ms-win-crt-stdio-l1-1-0

setvbuf
fwrite
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
_close
_write
_read
feof
ferror
fgets
_fileno
fseek
ftell
_setmode
fread
fputc
__stdio_common_vsscanf
_lseeki64
_wfopen
fopen
fflush
fclose
__stdio_common_vsnprintf_s
_open
fputs
__stdio_common_vfprintf
__stdio_common_vswprintf
__acrt_iob_func

api-ms-win-crt-math-l1-1-0

ceil
_fdopen
_ldsign
_fdsign
_finite
_isnan
_CIfmod
_dclass
_fdclass
_ldclass
floor
_dsign

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
_localtime64_s
_gmtime64
strftime

api-ms-win-crt-locale-l1-1-0

localeconv

crypt32

CertOpenSystemStoreA
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertGetIntendedKeyUsage
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_unlink
_fstat64
_stat64
_access

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

bcrypt

BCryptGenRandom

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 683KB - Virtual size: 683KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7be6e6ff811aefdf2964ede484ddb53d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

shell32

ole32

advapi32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

crypt32

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

bcrypt

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 683KB - Virtual size: 683KB

.data Size: 31KB - Virtual size: 47KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 125KB - Virtual size: 124KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 683KB - Virtual size: 683KB

.data
Size: 31KB - Virtual size: 47KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 125KB - Virtual size: 124KB