357a192ee6215f41f22918900e4a7f37b54ef2db09f2897ba9f762cc427bc28b

Sharing

Copy URL Twitter E-mail

General

Target

357a192ee6215f41f22918900e4a7f37b54ef2db09f2897ba9f762cc427bc28b
Size

810KB
MD5

bbb527c97785c4f018cced17294160d9
SHA1

e058bfcc18a5f791074aa3a188c9bb8dd3c7e71f
SHA256

357a192ee6215f41f22918900e4a7f37b54ef2db09f2897ba9f762cc427bc28b
SHA512

e3772dc69d48f38c27bef95f8f68b32ae94a53024278d6201b015c505ca691e856d9344598132a49fd234e20140dfdf0a13c10b7e0190279a611bdf955e3b696
SSDEEP

24576:BaKWDMuUUJnemWqYDgN2/FbmCZDy2nYP:Ba2uLZem6DgN2Rp9PYP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
357a192ee6215f41f22918900e4a7f37b54ef2db09f2897ba9f762cc427bc28b

Files

357a192ee6215f41f22918900e4a7f37b54ef2db09f2897ba9f762cc427bc28b
.dll windows x86

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

LoadStringW
SendMessageW
IsWindow
GetSystemMetrics
MessageBoxW
EnumChildWindows
FindWindowA
FindWindowExA
GetClassNameA
GetWindowThreadProcessId
GetWindowTextA
GetDesktopWindow
FindWindowW
IsCharAlphaA
LoadStringA

msi

ord31
ord70
ord8
ord160
ord50
ord116
ord125
ord118
ord145
ord171
ord159
ord47
ord49
ord74
ord147
ord103
ord17
ord121

shell32

Shell_NotifyIconW

setupapi

InstallHinfSectionW

kernel32

GetFileAttributesExW
SetEndOfFile
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
QueryPerformanceFrequency
VerifyVersionInfoW
GetProductInfo
GetNativeSystemInfo
VerSetConditionMask
GetTickCount
GetLocalTime
GetSystemTime
LoadLibraryExA
VirtualQuery
VirtualProtect
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetDriveTypeA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetModuleHandleA
GetModuleHandleW
GetProcAddress
SizeofResource
FindResourceW
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryW
CreateFileA
GetFileInformationByHandle
ReadFile
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetSystemInfo
GetVersionExA
FreeLibrary
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
RemoveDirectoryW
Sleep
GetCurrentThread
MoveFileExW
FileTimeToLocalFileTime
SetLastError
GetSystemTimeAsFileTime
FormatMessageW
FlushFileBuffers
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
SetEnvironmentVariableW
GetDriveTypeW
GetVolumeInformationW
GetTempPathW
GetSystemDirectoryW
SetCurrentDirectoryW
GetDiskFreeSpaceExW
HeapReAlloc
GetFullPathNameW
SetFileAttributesW
OutputDebugStringA
GetModuleFileNameW
WriteConsoleW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleExW
GetACP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleOutputCP
GetConsoleMode
GetFileType
SetStdHandle
PeekNamedPipe
GetTimeZoneInformation
ExitProcess

Exports

Exports

VMAppSearch
VMAppTerminate
VMAutoSelectInstallDrive
VMCleanupTrayIcons
VMDecoupleChildInstaller
VMDeleteFilesAndFolders
VMDetectRunningVM
VMDetectWin2003R2
VMDisplayWarnings
VMEnterPlayerLicense
VMEnterWorkstationLicense
VMInstallInfKernelDriver
VMInstallKernelDriver
VMIsRepairSafe
VMMessageBox
VMNeedValidLicense
VMReadInProperties
VMRegSvr
VMRemoveRegistryValues64
VMResetRegSecurity
VMServiceFailureConfig
VMSetRealVersionNT
VMSetVMSysVer
VMStopRunningServices
VMUninstallInfKernelDriver
VMUninstallKernelDriver
VMUnregSvr
VMValidateINSTALLDIR
VMValidatePlayerLicense
VMValidateSerialNumber
VMValidateWorkstationLicense
VMWriteRegistryValues64

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

File Characteristics

Imports

user32

msi

shell32

setupapi

kernel32

Exports

Exports

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 177KB - Virtual size: 176KB

.data Size: 51KB - Virtual size: 61KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 177KB - Virtual size: 176KB

.data
Size: 51KB - Virtual size: 61KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 25KB - Virtual size: 24KB