f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc

Sharing

Copy URL Twitter E-mail

General

Target

f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc
Size

243KB
MD5

3591a1cba578b4da06f553aa774afb83
SHA1

e82e73f04023e172278121a9075483fa6c2ee634
SHA256

f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc
SHA512

3c3ae7bffdd54a7091d8ffd0100afcd8673465f617e90bfb48c8c7995a31ec963d57e9a9bd3f27870a541416352b14352dfe59c3838da074ccb1be4ba09d2adf
SSDEEP

3072:AM+wA4RhUzrp9XiP/GS2H3wX27afZ/LxaHbISUJ1TeN5EbQ/IK:R+W3wrpxiP/GSw3wXk0xDSUveEbu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc

Files

f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc
.dll windows x86

e0c789204f3dcbb56bbfd2a784824677

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalFree
FormatMessageA
GlobalUnlock
GlobalFree
SetLastError
GetLastError
WriteFile
SetFilePointer
FlushFileBuffers
GetCurrentProcess
CreateFileA
lstrlenA
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
WaitForSingleObject
WritePrivateProfileStringA
GlobalFlags
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GlobalAddAtomA
GetCurrentProcessId
GetVersionExA
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
GetModuleHandleW
GetCPInfo
GetOEMCP
HeapAlloc
ExitProcess
HeapFree
GetSystemTimeAsFileTime
RtlUnwind
HeapReAlloc
RaiseException
VirtualAlloc
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
LoadLibraryA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
FreeLibrary
GetProcAddress
DebugBreak
OutputDebugStringA
Sleep
CloseHandle
GetStartupInfoA
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetModuleHandleA
GetCommandLineA

user32

MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
GetForegroundWindow
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
GetSysColorBrush
LoadCursorA
ShowWindow
DestroyMenu
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
EnableWindow
GetWindow
GetDlgCtrlID
GetWindowRect
GetWindowLongA
GetClassNameA
PtInRect
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
SendMessageA
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
UnhookWindowsHookEx
GetSystemMetrics
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostMessageA
PostQuitMessage
MessageBoxA
CharLowerA
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
GetWindowTextA

shlwapi

PathFindExtensionA

ws2_32

WSAStartup
socket
ioctlsocket
gethostbyname
ntohs
connect
select
getsockopt
WSACleanup
closesocket
recv
send
setsockopt

oleacc

LresultFromObject
CreateStdAccessibleObject

gdi32

GetStockObject
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteDC
DeleteObject
PtVisible
RectVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetDeviceCaps
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

??4Cdemo@@QAEAAV0@ABV0@@Z
RegisterModule

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0c789204f3dcbb56bbfd2a784824677

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

ws2_32

oleacc

gdi32

winspool.drv

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 157KB - Virtual size: 156KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 157KB - Virtual size: 156KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 31KB - Virtual size: 30KB