SecuriteInfo[.]com[.]Trojan[.]Loader[.]1543[.]18393[.]1715[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.Loader.1543.18393.1715.dll
Size

40KB
MD5

6f965c8c40359ae322c817ef591ae192
SHA1

a50cd1ca6742f3b288d7704315dd2f98e35df030
SHA256

01ae07cc4886a97d2413983767812eef5223012f32c9b22d1f72df9f89e87809
SHA512

22e8d3a29824958a0f4ce7be1ee745a9e9b2bc6a73d88aa8035d922da2ffb07b19e5f1fb8a6c18792ee4b0fcd1af9357599c92637cf710e4e730ee01ab3d7c34
SSDEEP

768:nznxqKnNnm/GSOoGVFd5wsbYm/EO6hNKoWpVfq2Ua6WEx8:nbNmGSjGE1SVfqkNEx8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.Loader.1543.18393.1715.dll

Files

SecuriteInfo.com.Trojan.Loader.1543.18393.1715.dll
.dll windows x86

191939e12dbb280104ea0d469a3d93c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
CloseHandle
WaitForSingleObject
CreateThread
ReadFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
lstrcatW
GetFileSize
GetFileAttributesA
CreateFileW
CreateFileA
VirtualAlloc
GetEnvironmentVariableW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringEx
HeapSize
HeapReAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
IsDebuggerPresent
Sleep
GetModuleHandleW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
GetProcessHeap
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
GetModuleFileNameW
SetLastError
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
WriteConsoleW

crypt32

CertComparePublicKeyInfo
CertSaveStore
CryptVerifyDetachedMessageHash
CertDuplicateCertificateContext
CertVerifyRevocation

resutils

ResUtilGetEnvironmentWithNetName
ResUtilGetProperties
ResUtilDupString
ResUtilGetPropertiesToParameterBlock
ClusWorkerStart
ResUtilStopService
ResUtilGetDwordProperty
ResUtilGetPrivateProperties

oleaut32

VarUI1FromI2
VarR4FromCy
VarI4FromUI4
SafeArrayGetRecordInfo
VarUI1FromStr
VarCyFromR4
VarUI2FromUI1
VarR8FromI2
SafeArrayGetDim
OleCreatePropertyFrame
VarR4FromI4
VarSu

urlmon

CreateURLMoniker
HlinkSimpleNavigateToMoniker
CoInternetGetProtocolFlags
IsLoggingEnabledA
RevokeBindStatusCallback

setupapi

SetupFindFirstLineW
SetupDiSetSelectedDriverA
SetupDiOpenDeviceInfoA
SetupDiCallClassInstaller
SetupGetStringFieldA

Exports

Exports

HvDeclY
_FileExcists@4
_ReaddFileContents@12
_WrigteToFile@12

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

191939e12dbb280104ea0d469a3d93c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

crypt32

resutils

oleaut32

urlmon

setupapi

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 480B