e4ea13d40944848a31bd60abb819ba8948907a3dfe9ea1f6d0a048110dc74fb2

Sharing

Copy URL Twitter E-mail

General

Target

e4ea13d40944848a31bd60abb819ba8948907a3dfe9ea1f6d0a048110dc74fb2
Size

810KB
MD5

202c71c3d8b32f0aeba4f68cc84f8d67
SHA1

54ce8252f1bd5e94f1a0ffd2207fb58558f3fa29
SHA256

e4ea13d40944848a31bd60abb819ba8948907a3dfe9ea1f6d0a048110dc74fb2
SHA512

2c42187033a474f7abf3499db93aab156b91fbcce53357bc0f4063af5805c49a146bca13f7e2bddfb82bb9c4cf0b985e8f641c9ab3d76306517501a8184b2093
SSDEEP

24576:QaKWDMuUUJnemWqYDgN2/Fb8sZZ4wJqP:Qa2uLZem6DgN2RpjFqP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4ea13d40944848a31bd60abb819ba8948907a3dfe9ea1f6d0a048110dc74fb2

Files

e4ea13d40944848a31bd60abb819ba8948907a3dfe9ea1f6d0a048110dc74fb2
.dll windows x86

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

LoadStringW
SendMessageW
IsWindow
GetSystemMetrics
MessageBoxW
EnumChildWindows
FindWindowA
FindWindowExA
GetClassNameA
GetWindowThreadProcessId
GetWindowTextA
GetDesktopWindow
FindWindowW
IsCharAlphaA
LoadStringA

msi

ord31
ord70
ord8
ord160
ord50
ord116
ord125
ord118
ord145
ord171
ord159
ord47
ord49
ord74
ord147
ord103
ord17
ord121

shell32

Shell_NotifyIconW

setupapi

InstallHinfSectionW

kernel32

GetFileAttributesExW
SetEndOfFile
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
QueryPerformanceFrequency
VerifyVersionInfoW
GetProductInfo
GetNativeSystemInfo
VerSetConditionMask
GetTickCount
GetLocalTime
GetSystemTime
LoadLibraryExA
VirtualQuery
VirtualProtect
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetDriveTypeA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetModuleHandleA
GetModuleHandleW
GetProcAddress
SizeofResource
FindResourceW
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryW
CreateFileA
GetFileInformationByHandle
ReadFile
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetSystemInfo
GetVersionExA
FreeLibrary
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
RemoveDirectoryW
Sleep
GetCurrentThread
MoveFileExW
FileTimeToLocalFileTime
SetLastError
GetSystemTimeAsFileTime
FormatMessageW
FlushFileBuffers
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
SetEnvironmentVariableW
GetDriveTypeW
GetVolumeInformationW
GetTempPathW
GetSystemDirectoryW
SetCurrentDirectoryW
GetDiskFreeSpaceExW
HeapReAlloc
GetFullPathNameW
SetFileAttributesW
OutputDebugStringA
GetModuleFileNameW
WriteConsoleW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleExW
GetACP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleOutputCP
GetConsoleMode
GetFileType
SetStdHandle
PeekNamedPipe
GetTimeZoneInformation
ExitProcess

Exports

Exports

VMAppSearch
VMAppTerminate
VMAutoSelectInstallDrive
VMCleanupTrayIcons
VMDecoupleChildInstaller
VMDeleteFilesAndFolders
VMDetectRunningVM
VMDetectWin2003R2
VMDisplayWarnings
VMEnterPlayerLicense
VMEnterWorkstationLicense
VMInstallInfKernelDriver
VMInstallKernelDriver
VMIsRepairSafe
VMMessageBox
VMNeedValidLicense
VMReadInProperties
VMRegSvr
VMRemoveRegistryValues64
VMResetRegSecurity
VMServiceFailureConfig
VMSetRealVersionNT
VMSetVMSysVer
VMStopRunningServices
VMUninstallInfKernelDriver
VMUninstallKernelDriver
VMUnregSvr
VMValidateINSTALLDIR
VMValidatePlayerLicense
VMValidateSerialNumber
VMValidateWorkstationLicense
VMWriteRegistryValues64

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

File Characteristics

Imports

user32

msi

shell32

setupapi

kernel32

Exports

Exports

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 177KB - Virtual size: 176KB

.data Size: 51KB - Virtual size: 61KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 177KB - Virtual size: 176KB

.data
Size: 51KB - Virtual size: 61KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 25KB - Virtual size: 24KB