b08bded03e2e74f16498a7d634d435cfb33ab16637d88bac5b7a0a14c522e801

Sharing

Copy URL Twitter E-mail

General

Target

b08bded03e2e74f16498a7d634d435cfb33ab16637d88bac5b7a0a14c522e801
Size

1.3MB
MD5

694c418987041af1640c975425a306b0
SHA1

a48d211536ef8d4c36e0d484d3ac422934f346b2
SHA256

b08bded03e2e74f16498a7d634d435cfb33ab16637d88bac5b7a0a14c522e801
SHA512

6210d41b5258559697c7dbd3a8446bd093d0d1fbd577545a0edf58628711ce5fff94d86a095330a1fc447acda4e1670f8927a7bc929f1f2bc5971c9ef3810093
SSDEEP

24576:QS0ghNyNJhasRuitnJ3Loe6yXKJ8m8qs6+CsjS/jBiPcEZFAopNT:7dhNYnTnhLojyXKJ8As6+C0SbKcEXAon

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b08bded03e2e74f16498a7d634d435cfb33ab16637d88bac5b7a0a14c522e801

Files

b08bded03e2e74f16498a7d634d435cfb33ab16637d88bac5b7a0a14c522e801
.dll windows x86

6d76248158d76b501a51791a331dec83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord158
ord160
ord159
ord110
ord32
ord204
ord31
ord8
ord17
ord103
ord74
ord121
ord67
ord50
ord47
ord171
ord143
ord64
ord145
ord49
ord120
ord118
ord117
ord116
ord125

advapi32

RegDeleteKeyW
GetUserNameW
RegQueryInfoKeyW
RegEnumValueW
UnlockServiceDatabase
StartServiceA
QueryServiceStatus
GetExplicitEntriesFromAclW
SetSecurityDescriptorControl
GetTokenInformation
EqualSid
CopySid
AddAccessAllowedAceEx
RegUnLoadKeyW
RegLoadKeyW
CreateProcessAsUserW
OpenProcessToken
AdjustTokenPrivileges
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
LookupPrivilegeValueA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ChangeServiceConfig2A
CloseServiceHandle
OpenSCManagerA
OpenServiceA
GetSecurityInfo
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
OpenThreadToken
AccessCheck
AllocateAndInitializeSid
DuplicateToken
FreeSid
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
GetNamedSecurityInfoW
GetFileSecurityW
ImpersonateSelf
MapGenericMask
RevertToSelf
QueryServiceLockStatusA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
ChangeServiceConfigW
ControlService
CreateServiceW
DeleteService
EnumDependentServicesA
LockServiceDatabase
OpenServiceW
RegEnumKeyExW

shell32

Shell_NotifyIconA
SHChangeNotify
SHGetFolderPathW

ws2_32

WSCDeinstallProvider
WSCInstallProvider

setupapi

SetupDiCallClassInstaller
SetupDiCreateDeviceInfoA
SetupDiSetDeviceRegistryPropertyA
SetupCopyOEMInfW
SetupSetNonInteractiveMode
SetupGetNonInteractiveMode
SetupDiGetDeviceRegistryPropertyA
SetupGetInfInformationW
SetupQueryInfOriginalFileInformationW
SetupOpenInfFileW
SetupCloseInfFile
SetupGetLineTextW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInstanceIdW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiCreateDeviceInfoList
SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiGetDriverInstallParamsW
SetupDiCreateDeviceInfoW
SetupDiDeleteDeviceInfo
SetupDiGetSelectedDriverW
SetupDiSetClassInstallParamsW
SetupDiSetDriverInstallParamsW
SetupDiSetSelectedDevice
CM_Add_IDW
CM_Get_Device_IDW
CM_Get_Parent
CM_Locate_DevNodeW
CM_Reenumerate_DevNode
SetupDiGetINFClassW
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
SetupGetInfFileListA
SetupOpenInfFileA
SetupGetLineTextA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
GetProfilesDirectoryW

newdev

UpdateDriverForPlugAndPlayDevicesW

shlwapi

SHDeleteEmptyKeyW
PathCombineW
StrCmpW

user32

BroadcastSystemMessageA
MessageBoxW
FindWindowA
GetWindowThreadProcessId
RegisterWindowMessageW
wsprintfW
GetDesktopWindow
FindWindowW
SendMessageW
AttachThreadInput
IsWindow
SetFocus
keybd_event
SetActiveWindow
SetForegroundWindow
GetParent
FindWindowExW
EnumThreadWindows
GetWindowInfo
LoadStringW
LoadStringA
SendMessageA
GetWindowTextA

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

kernel32

PeekNamedPipe
ExitProcess
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
GetTimeZoneInformation
GetDateFormatW
TlsSetValue
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
ReadConsoleW
RtlUnwind
TlsFree
TlsGetValue
TlsAlloc
InterlockedFlushSList
GetTimeFormatW
HeapReAlloc
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetFileAttributesA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
GetCPInfo
CompareStringEx
LCMapStringEx
EncodePointer
GetLocaleInfoEx
GetStringTypeW
LoadLibraryExA
VirtualQuery
VirtualProtect
InitializeCriticalSection
GetACP
CreateFileMappingA
OutputDebugStringW
QueryPerformanceFrequency
QueryPerformanceCounter
MultiByteToWideChar
Process32Next
Process32First
CreateToolhelp32Snapshot
VerifyVersionInfoA
GetProductInfo
GetNativeSystemInfo
GetModuleFileNameW
GetFullPathNameW
WriteConsoleW
LoadLibraryA
GetComputerNameExW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetTickCount
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
lstrcmpA
UnmapViewOfFile
MapViewOfFile
GetCurrentThreadId
CreateThread
CreateEventA
SetEvent
GetEnvironmentVariableW
VerifyVersionInfoW
DosDateTimeToFileTime
VerSetConditionMask
GetProcessHeap
HeapFree
HeapAlloc
SetCurrentDirectoryA
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileInformationByHandle
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesA
SetFileAttributesW
GetTempPathW
GetTempPathA
GetTempFileNameA
CloseHandle
GetLastError
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
ProcessIdToSessionId
OpenProcess
GetSystemTime
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemWow64DirectoryW
FreeLibrary
GetModuleHandleA
GetProcAddress
SizeofResource
LoadLibraryW
LocalFree
FindResourceA
CopyFileW
MoveFileW
MoveFileExW
WideCharToMultiByte
DeviceIoControl
QueryDosDeviceW
GetCurrentThread
SetLastError
OutputDebugStringA
FlushFileBuffers
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DuplicateHandle
FindFirstFileExW
GetFileAttributesExW
GetFileType
GetVolumeInformationW
GetProcessTimes
GetDriveTypeW
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
GetVersionExA
GetModuleHandleW
GetModuleHandleExW
GetCurrentDirectoryW
CreateFileA
GetExitCodeProcess
CreateProcessW
GetSystemInfo
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileSizeEx
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
FormatMessageW

wintrust

WinVerifyTrust

crypt32

CryptQueryObject
CertGetNameStringW
CertAddCertificateContextToStore
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CryptMsgGetParam
CryptMsgUpdate
CryptMsgClose
CryptMsgOpenToDecode

Exports

Exports

VMBackupRestoreFile
VMCheckIncompatibleViewPresent
VMCheckReboot
VMCheckRequirements
VMCleanLegacyTools
VMCleanOldPerUserMSITools
VMCleanupSupportFiles
VMClearUninstallProps
VMConfigRunRegistry
VMCopyInstallVMWSU
VMCopySupportFiles
VMCreateSecureProgramDataDirectories
VMDeleteFiles
VMDisableUSBSelectiveSuspendPwrSettings
VMDisplayVSSRqdSvcsWarning
VMEnableUSBSelectiveSuspendPwrSettings
VMEtcHostsCleanup
VMFetchSupportFiles
VMHandleFeatureNameChanges
VMInitializeVGAuthConf
VMInstallAudioDriver
VMInstallEfiFwDriver
VMInstallHgfsDriver
VMInstallLegacyDriver
VMInstallPS2MouseDriver
VMInstallPVSCSIDriver
VMInstallUSBMouseDriver
VMInstallVMCIDriver
VMInstallVMToolsService
VMInstallVMXNet3Driver
VMInstallVMXNetDriver
VMInstallVideoDriver
VMInstallVmLocationDriver
VMInstallVmwSdrDriver
VMInstallVmwVaudioDriver
VMInstallVmwVaudioInDriver
VMInstallVmwVdisplayDriver
VMInstallVmwVwebCamDriver
VMLegacyOrMinorUpgradeMigrateToolsConf
VMLogEnd
VMLogStart
VMManageVsepamsi
VMMinorUpgradeMigrateHGFS
VMMofCompile
VMPassPsScriptDirProps
VMPassUninstallProps
VMPredictInstallSessionReboot
VMRemoveVMDesched
VMReportExpectedTicks
VMResetIconCache
VMResetOldProductFeatureStates
VMRollbackRunRegistry
VMRun
VMRunLegacyDriverActionW
VMScheduleRebootPrompt
VMSendMsiLogToHost
VMServiceConfigRestart
VMSetDiskTimeOut
VMSetPerfSettings
VMSetToolsUninstalled
VMSetVersionNTBuild
VMStartStopServices
VMStartVMToolsService
VMStartVMwareProcesses
VMStopVMToolsService
VMStopVMwareProcesses
VMUninstallAudioDriver
VMUninstallEfiFwDriver
VMUninstallGHIRestoreGuestHandlers
VMUninstallHgfsDriver
VMUninstallLegacyDriver
VMUninstallOldHgfsDriver
VMUninstallPS2MouseDriver
VMUninstallPVSCSIDriver
VMUninstallPerUserHgfsSharedFolders
VMUninstallUSBMouseDriver
VMUninstallVMCIDriver
VMUninstallVMToolsService
VMUninstallVMXNet3Driver
VMUninstallVMXNetDriver
VMUninstallVideoDriver
VMUninstallVmLocationDriver
VMUninstallVmwSdrDriver
VMUninstallVmwVaudioDriver
VMUninstallVmwVaudioInDriver
VMUninstallVmwVdisplayDriver
VMUninstallVmwVwebCamDriver
VMUnmountImageCancel
VMUnmountImageFailure
VMUnmountImageSuccess
VMUpdateManifestFile
VMVerifyCertHint

Sections

.text
Size: 884KB - Virtual size: 884KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d76248158d76b501a51791a331dec83

Headers

DLL Characteristics

File Characteristics

Imports

msi

advapi32

shell32

ws2_32

setupapi

userenv

newdev

shlwapi

user32

ole32

kernel32

wintrust

crypt32

Exports

Exports

Sections

.text Size: 884KB - Virtual size: 884KB

.rdata Size: 314KB - Virtual size: 314KB

.data Size: 57KB - Virtual size: 80KB

.didat Size: 512B - Virtual size: 28B

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 44KB - Virtual size: 44KB

.text
Size: 884KB - Virtual size: 884KB

.rdata
Size: 314KB - Virtual size: 314KB

.data
Size: 57KB - Virtual size: 80KB

.didat
Size: 512B - Virtual size: 28B

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 44KB - Virtual size: 44KB