cf12d3aea7066695a28fcea1cdb344cdc33248128bea58864d0103f4212e7130

Sharing

Copy URL Twitter E-mail

General

Target

cf12d3aea7066695a28fcea1cdb344cdc33248128bea58864d0103f4212e7130
Size

5.4MB
MD5

8bf05139d1668ba4b035d427017ff084
SHA1

907fc5f48ee1c524ee0e52ba532e06aebf54513e
SHA256

cf12d3aea7066695a28fcea1cdb344cdc33248128bea58864d0103f4212e7130
SHA512

beef8aaf6eb945c8b3580f68343f06e992042128d605000436bce67eb4ff8385f77a0a17be48c422737af1ab9fc05a16dddfe3268b36a361da9113147cc3b41b
SSDEEP

98304:1AdDlU813tyI5VBn6uBIkYY7oVk0MHhfIpz9CWZ5E9S04NjP2fPtujhb:1SUg3VBBxoiHlKzgWZ5EI0eifPtuj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf12d3aea7066695a28fcea1cdb344cdc33248128bea58864d0103f4212e7130

Files

cf12d3aea7066695a28fcea1cdb344cdc33248128bea58864d0103f4212e7130
.dll windows x86

7a6671334e71adaa75864a7aff5c3a50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
LocalAlloc
LocalFree
CloseHandle
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateWaitableTimerA
SetWaitableTimer
GetModuleHandleA
VirtualProtect
GetFileAttributesA
CreateToolhelp32Snapshot
Module32Next
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
CreateFileA
Process32First
Process32Next
VirtualAlloc
VirtualFree
GetCurrentProcessId
CreateMutexA
OpenEventA
CreateEventA
GetCurrentProcess
GetProcAddress
VirtualQueryEx
VirtualProtectEx
WriteProcessMemory
ReadProcessMemory
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetEnvironmentVariableA
GetTickCount
ReadFile
GetFileSize
GetCommandLineA
GetModuleFileNameA
LCMapStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
lstrcpyn
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DispatchMessageA
MessageBoxA
PeekMessageA
GetClassNameA
GetWindowTextA
IsWindowVisible
GetMessageA
GetWindowThreadProcessId
TranslateMessage
wsprintfA

shell32

ShellExecuteA

ws2_32

WSACleanup
select
WSAAsyncSelect
ntohs
getsockname
recv
send
gethostbyname
connect
inet_addr
htons
socket
closesocket
WSAStartup

msvcrt

malloc
strncmp
??3@YAXPAX@Z
strncpy
_CIfmod
strtod
_ftol
atoi
free
memmove
realloc
strchr
strrchr
modf
_atoi64
__CxxFrameHandler
rand
srand
sprintf
??2@YAPAXI@Z

Exports

Exports

ADVANCEDSETUPDIALOG
AbortPrinter
AddFormA
AddFormW
AddJobA
AddJobW
AddMonitorA
AddMonitorW
AddPortA
AddPortExA
AddPortExW
AddPortW
AddPrintProcessorA
AddPrintProcessorW
AddPrintProvidorA
AddPrintProvidorW
AddPrinterA
AddPrinterConnection2A
AddPrinterConnection2W
AddPrinterConnectionA
AddPrinterConnectionW
AddPrinterDriverA
AddPrinterDriverExA
AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
AdvancedDocumentPropertiesA
AdvancedDocumentPropertiesW
AdvancedSetupDialog1
ClosePrinter
CloseSpoolFileHandle
CommitSpoolData
ConfigurePortA
ConfigurePortW
ConnectToPrinterDlg
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
CorePrinterDriverInstalledA
CorePrinterDriverInstalledW
CreatePrintAsyncNotifyChannel
CreatePrinterIC
DEVICECAPABILITIES
DEVICEMODE
DeleteFormA
DeleteFormW
DeleteMonitorA
DeleteMonitorW
DeletePortA
DeletePortW
DeletePrintProcessorA
DeletePrintProcessorW
DeletePrintProvidorA
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionA
DeletePrinterConnectionW
DeletePrinterDataA
DeletePrinterDataExA
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverA
DeletePrinterDriverExA
DeletePrinterDriverExW
DeletePrinterDriverPackageA
DeletePrinterDriverPackageW
DeletePrinterDriverW
DeletePrinterIC
DeletePrinterKeyA
DeletePrinterKeyW
DevQueryPrint
DevQueryPrintEx
DeviceCapabilities1
DeviceCapabilitiesA
DeviceCapabilitiesW
DeviceMode1
DevicePropertySheets
DocumentEvent
DocumentPropertiesA
DocumentPropertiesW
DocumentPropertySheets
EXTDEVICEMODE
EndDocPrinter
EndPagePrinter
EnumFormsA
EnumFormsW
EnumJobsA
EnumJobsW
EnumMonitorsA
EnumMonitorsW
EnumPortsA
EnumPortsW
EnumPrintProcessorDatatypesA
EnumPrintProcessorDatatypesW
EnumPrintProcessorsA
EnumPrintProcessorsW
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversA
EnumPrinterDriversW
EnumPrinterKeyA
EnumPrinterKeyW
EnumPrintersA
EnumPrintersW
ExtDeviceMode1
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FlushPrinter
FreePrinterNotifyInfo
GetCorePrinterDriversA
GetCorePrinterDriversW
GetDefaultPrinterA
GetDefaultPrinterW
GetFormA
GetFormW
GetJobA
GetJobW
GetPrintExecutionData
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriver2A
GetPrinterDriver2W
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetPrinterDriverDirectoryW
GetPrinterDriverPackagePathA
GetPrinterDriverPackagePathW
GetPrinterDriverW
GetPrinterW
GetSpoolFileHandle
InstallPrinterDriverFromPackageA
InstallPrinterDriverFromPackageW
IsValidDevmodeA
IsValidDevmodeW
OpenPrinter2A
OpenPrinter2W
OpenPrinterA
OpenPrinterW
PerfClose
PerfCollect
PerfOpen
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
PrinterMessageBoxW
PrinterProperties
QueryColorProfile
QueryRemoteFonts
QuerySpoolMode
ReadPrinter
RegisterForPrintAsyncNotifications
ReportJobProcessingProgress
ResetPrinterA
ResetPrinterW
ScheduleJob
SeekPrinter
SetDefaultPrinterA
SetDefaultPrinterW
SetFormA
SetFormW
SetJobA
SetJobW
SetPortA
SetPortW
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
SetPrinterDataExW
SetPrinterDataW
SetPrinterW
SplDriverUnloadComplete
SpoolerDevQueryPrintW
SpoolerPrinterEvent
StartDocDlgA
StartDocDlgW
StartDocPrinterA
StartDocPrinterW
StartPagePrinter
UnRegisterForPrintAsyncNotifications
UploadPrinterDriverPackageA
UploadPrinterDriverPackageW
WaitForPrinterChange
WritePrinter
XcvDataW

Sections

.text
Size: - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DVI
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.^{x
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.4Yu
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a6671334e71adaa75864a7aff5c3a50

Headers

File Characteristics

Imports

kernel32

user32

shell32

ws2_32

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 261KB

.rdata Size: - Virtual size: 7KB

.data Size: - Virtual size: 60KB

.DVI Size: - Virtual size: 3.2MB

.^{x Size: 4KB - Virtual size: 828B

.4Yu Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 664B

.text
Size: - Virtual size: 261KB

.rdata
Size: - Virtual size: 7KB

.data
Size: - Virtual size: 60KB

.DVI
Size: - Virtual size: 3.2MB

.^{x
Size: 4KB - Virtual size: 828B

.4Yu
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 664B