0aafb40db3e15ff16cb73d492611cf497e159e83b73cf41b9edce56162566865

Sharing

Copy URL Twitter E-mail

General

Target

0aafb40db3e15ff16cb73d492611cf497e159e83b73cf41b9edce56162566865
Size

351KB
MD5

8c440a892bd9d9fa303d9cd0a1a49199
SHA1

b527c9e70906a62b06aa95a4cba5050e2e8e0642
SHA256

0aafb40db3e15ff16cb73d492611cf497e159e83b73cf41b9edce56162566865
SHA512

15c6b5741c92ae18df8bf8785e548b4285a463376d09c73e9214bebe9cd9da7d3598402f863e3c417b3d05eb69eb9f608a3f99ee6182890b6a35a95949c831a3
SSDEEP

6144:NhuoeBg+4utASWwZh9x28+K4KgUuZCRfYMJVtBLURoSBKhm1+nwQnZvncXTsKdKU:TeBcutASWwZA8+YgUuZCRfYMJVtBLURR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aafb40db3e15ff16cb73d492611cf497e159e83b73cf41b9edce56162566865

Files

0aafb40db3e15ff16cb73d492611cf497e159e83b73cf41b9edce56162566865
.dll regsvr32 windows x86

b4b00f3d50e3ec8a1ecc977815ec6ddb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

vDbgPrintExWithPrefix

advapi32

RegCloseKey
RegEnumKeyW
RegOpenKeyW
RegQueryValueA
RegQueryValueW

kernel32

DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcatW
lstrcmpW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW

msacm32

acmFormatChooseW
acmFormatDetailsW
acmFormatSuggest
acmFormatTagDetailsW
acmMetrics
acmStreamClose
acmStreamConvert
acmStreamOpen
acmStreamPrepareHeader
acmStreamSize
acmStreamUnprepareHeader

msvcrt

__dllonexit
_amsg_exit
_assert
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memcpy
memmove
memset
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
wcsrchr

msvfw32

ICClose
ICCompress
ICCompressorChoose
ICCompressorFree
ICDecompress
ICGetDisplayFormat
ICGetInfo
ICLocate
ICOpen
ICSendMessage

ole32

CoCreateInstance
CoTaskMemAlloc
OleInitialize

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrStubGetBuffer
NdrStubInitialize
RpcRaiseException

winmm

mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioOpenA
mmioOpenW
mmioRead
mmioSeek
mmioWrite

user32

CheckDlgButton
DialogBoxParamW
EnableWindow
EndDialog
GetDlgItem
GetDlgItemInt
IsDlgButtonChecked
IsRectEmpty
LoadStringW
SendDlgItemMessageW
SendMessageW
SetDlgItemInt
SetDlgItemTextW
SetRect
SetRectEmpty
wsprintfA
wsprintfW

Exports

Exports

AVIBuildFilter
AVIBuildFilterA
AVIBuildFilterW
AVIClearClipboard
AVIFileAddRef
AVIFileCreateStream
AVIFileCreateStreamA
AVIFileCreateStreamW
AVIFileEndRecord
AVIFileExit
AVIFileGetStream
AVIFileInfo
AVIFileInfoA
AVIFileInfoW
AVIFileInit
AVIFileOpen
AVIFileOpenA
AVIFileOpenW
AVIFileReadData
AVIFileRelease
AVIFileWriteData
AVIGetFromClipboard
AVIMakeCompressedStream
AVIMakeFileFromStreams
AVIMakeStreamFromClipboard
AVIPutFileOnClipboard
AVISave
AVISaveA
AVISaveOptions
AVISaveOptionsFree
AVISaveV
AVISaveVA
AVISaveVW
AVISaveW
AVIStreamAddRef
AVIStreamBeginStreaming
AVIStreamCreate
AVIStreamEndStreaming
AVIStreamFindSample
AVIStreamGetFrame
AVIStreamGetFrameClose
AVIStreamGetFrameOpen
AVIStreamInfo
AVIStreamInfoA
AVIStreamInfoW
AVIStreamLength
AVIStreamOpenFromFile
AVIStreamOpenFromFileA
AVIStreamOpenFromFileW
AVIStreamRead
AVIStreamReadData
AVIStreamReadFormat
AVIStreamRelease
AVIStreamSampleToTime
AVIStreamSetFormat
AVIStreamStart
AVIStreamTimeToSample
AVIStreamWrite
AVIStreamWriteData
CreateEditableStream
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EditStreamClone
EditStreamCopy
EditStreamCut
EditStreamPaste
EditStreamSetInfo
EditStreamSetInfoA
EditStreamSetInfoW
EditStreamSetName
EditStreamSetNameA
EditStreamSetNameW
IID_IAVIEditStream
IID_IAVIFile
IID_IAVIStream
IID_IGetFrame

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4b00f3d50e3ec8a1ecc977815ec6ddb

Headers

File Characteristics

Imports

ntdll

advapi32

kernel32

msacm32

msvcrt

msvfw32

ole32

rpcrt4

winmm

user32

Exports

Exports

Sections

.text Size: 125KB - Virtual size: 124KB

.data Size: 512B - Virtual size: 256B

.rdata Size: 16KB - Virtual size: 15KB

/4 Size: 512B - Virtual size: 20B

.bss Size: - Virtual size: 5KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 30KB - Virtual size: 30KB

.reloc Size: 5KB - Virtual size: 5KB

.rossym Size: 162KB - Virtual size: 162KB

.text
Size: 125KB - Virtual size: 124KB

.data
Size: 512B - Virtual size: 256B

.rdata
Size: 16KB - Virtual size: 15KB

/4
Size: 512B - Virtual size: 20B

.bss
Size: - Virtual size: 5KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 30KB - Virtual size: 30KB

.reloc
Size: 5KB - Virtual size: 5KB

.rossym
Size: 162KB - Virtual size: 162KB