75af318399b5559c4d044059ad1331dbf585ccceb1ef16e330d3f652933b2bd4

Sharing

Copy URL Twitter E-mail

General

Target

75af318399b5559c4d044059ad1331dbf585ccceb1ef16e330d3f652933b2bd4
Size

5.9MB
MD5

b37dd3a0fd0dd62543387cf91690abcb
SHA1

991b8d5e0957118885bf8ff685b44ba274e135fc
SHA256

75af318399b5559c4d044059ad1331dbf585ccceb1ef16e330d3f652933b2bd4
SHA512

29fc3f5d023b459fb02d197d3761d6478f8915f4b4cbe774b64f6d942cfaf67a7c3a5a0a70e5039b389835468f8b314e0ea5a85543145de53824c2c18f8c6ec3
SSDEEP

98304:HZN8S4h6I/9BKFDrMzg94w5UiGxqcofnxrpFJ/tch:5N8S4hPzarMzh9xqcSZe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75af318399b5559c4d044059ad1331dbf585ccceb1ef16e330d3f652933b2bd4

Files

75af318399b5559c4d044059ad1331dbf585ccceb1ef16e330d3f652933b2bd4
.dll windows x86

b818bed3bbdb073fdc76b0f5228a2d6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextW
CryptGenRandom
SystemFunction036

shell32

SHGetFolderPathW
SHGetSpecialFolderPathA

ws2_32

freeaddrinfo
getaddrinfo
getprotobynumber
getservbyname
listen
getsockopt
getsockname
connect
closesocket
accept
send
WSAGetOverlappedResult
setsockopt
sendto
recvfrom
ntohs
ntohl
htons
htonl
bind
getpeername
WSASetLastError
WSASend
WSARecv
WSAGetLastError
ioctlsocket
WSAIoctl
WSAAddressToStringA
WSACreateEvent
WSACloseEvent
inet_pton
select
recv
WSAStartup
socket
inet_ntoa
WSASendMsg

kernel32

LCMapStringEx
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
CloseHandle
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetLastError
GetVersion
FreeLibrary
GetProcAddress
VerSetConditionMask
VerifyVersionInfoW
GetSystemDirectoryW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
GetSystemTimeAsFileTime
GetTickCount
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
CreateSemaphoreW
TryEnterCriticalSection
SetEvent
ResetEvent
CreateEventW
GetCurrentThreadId
CreateFileW
GetQueuedCompletionStatusEx
DeviceIoControl
CancelIoEx
CancelIo
SetFileCompletionNotificationModes
Sleep
InitializeCriticalSectionEx
GetOverlappedResult
InitializeSRWLock
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
SetStdHandle
GetFileType
SetFilePointerEx
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetConsoleMode
ReadConsoleW
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
WriteFile
GetConsoleCP
GetTimeZoneInformation
GetModuleFileNameW
GetCurrentThread
GetStdHandle
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
HeapReAlloc
SetEndOfFile
WideCharToMultiByte
FlushFileBuffers
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
OutputDebugStringW
GetStringTypeW
WriteConsoleW
HeapSize
DecodePointer
WaitForMultipleObjects
InitOnceExecuteOnce
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
DeleteFileA
HeapCompact
HeapDestroy
UnlockFile
InitializeCriticalSection
DeleteFileW
GetCurrentDirectoryA
CreateDirectoryW
GetProcessTimes
GetSystemTimes
GetVersionExW
LoadLibraryA
SetThreadPriority
OpenThread
GetThreadTimes
QueryThreadCycleTime
VirtualUnlock
OutputDebugStringA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
GetModuleHandleA

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantClear

winmm

timeGetTime

ole32

CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

Exports

Exports

?EnableLogOutput@AgoraAudioProcessing@AgoraUAP@@SGHULogOption@12@@Z
CreateAgoraAudioProcessing
GetAgoraDeviceUUID

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 632KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b818bed3bbdb073fdc76b0f5228a2d6c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ws2_32

kernel32

oleaut32

winmm

ole32

rpcrt4

Exports

Exports

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 632KB - Virtual size: 632KB

.data Size: 67KB - Virtual size: 171KB

.rsrc Size: 1024B - Virtual size: 848B

.reloc Size: 131KB - Virtual size: 130KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 632KB - Virtual size: 632KB

.data
Size: 67KB - Virtual size: 171KB

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 131KB - Virtual size: 130KB