22a6834d58dd30fb8e3ed06960ca192244b9e261c809ee26d2f2bc67307ab3b4

Sharing

Copy URL Twitter E-mail

General

Target

22a6834d58dd30fb8e3ed06960ca192244b9e261c809ee26d2f2bc67307ab3b4
Size

367KB
MD5

1a9a138b578b1fa9ff39cb3bb6a74c73
SHA1

9c336067c85ea019136ab55a4b9fad477d605039
SHA256

22a6834d58dd30fb8e3ed06960ca192244b9e261c809ee26d2f2bc67307ab3b4
SHA512

042c0fb6154a56d7a2760c0d3e332192ed4148c6cee5c5782042eb0cbe8226c1740265cd35cec7b8ad4e8cb7b58d3c33c161e085e60e5205de2fa8d47555c42c
SSDEEP

6144:QqAzvfv//oPQ2DFBJVEO8CoIHhvL9PJUakz2oV56ZPfMbOoHxMWfOB:Qq+Hv/wPQ25BJVx8C1HhvL9PJUam2o44

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22a6834d58dd30fb8e3ed06960ca192244b9e261c809ee26d2f2bc67307ab3b4

Files

22a6834d58dd30fb8e3ed06960ca192244b9e261c809ee26d2f2bc67307ab3b4
.dll windows x86

b1836ea7aed3094c34d31bb55e3c836b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
GetTempPathA
SetFilePointer
ReadFile
WriteFile
WideCharToMultiByte
MultiByteToWideChar
GetFullPathNameA
GetDriveTypeA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CreateSemaphoreA
ReleaseSemaphore
SetEvent
SetConsoleCtrlHandler
GetVolumeInformationA
GetFileAttributesA
CreateFileA
CreateDirectoryA
SystemTimeToFileTime
GetSystemTime
SetFileTime
GetFileInformationByHandle
GetComputerNameA
WaitForSingleObject
GetCurrentProcessId
OpenProcess
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SetEnvironmentVariableA
GetEnvironmentVariableA
LoadLibraryA
CreateEventA
lstrlenA
lstrcmpA
CloseHandle
GetCurrentProcess
GetProcessTimes
LocalFree
LocalAlloc
GetVersion
FindNextFileA
FindFirstFileA
FindClose
GetModuleHandleA
GetModuleFileNameA
LoadLibraryExA
SetErrorMode
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetSystemInfo
GetLastError
VirtualAlloc

ws2_32

WSASetLastError
WSAEnumProtocolsA

fbclient

ord248
ord249
fb_interpret
fb_get_master_interface
fb_shutdown
ord250
ord51
ord1
ord42
ord37
ord259

msvcp140

?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_Xbad_function_call@std@@YAXXZ
_Mbrtowc
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ

vcruntime140

memmove
memset
_except_handler4_common
memcpy
__std_exception_copy
__std_terminate
strstr
memchr
__std_exception_destroy
__std_type_info_destroy_list
_purecall
__CxxFrameHandler3
strchr
_CxxThrowException

api-ms-win-crt-string-l1-1-0

strncmp
_strnicmp
strncpy
toupper
isalpha
isdigit

api-ms-win-crt-stdio-l1-1-0

getc
fopen
_sopen_dispatch
__stdio_common_vsscanf
_fileno
feof
_getcwd
_get_osfhandle
_close
_read
_isatty
__stdio_common_vfprintf
__acrt_iob_func
fflush
fclose
ferror
__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
_seh_filter_dll
_initterm_e
_initterm
_cexit
_errno
terminate
strerror
_invalid_parameter_noinfo_noreturn
_crt_at_quick_exit

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_unlink
_access
_mkdir
_stat64i32

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-environment-l1-1-0

getenv_s
_putenv_s
getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

_ftime64

api-ms-win-crt-math-l1-1-0

_except1

mpr

WNetGetUniversalNameA
WNetCloseEnum
WNetEnumResourceA
WNetOpenEnumA

user32

CharUpperBuffA
CharLowerBuffA
MessageBoxA

advapi32

SetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclA
GetUserNameA
CreateWellKnownSid
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

ole32

CoCreateGuid

Exports

Exports

firebird_plugin

Sections

.text
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1836ea7aed3094c34d31bb55e3c836b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

fbclient

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

mpr

user32

advapi32

ole32

Exports

Exports

Sections

.text Size: 287KB - Virtual size: 287KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 287KB - Virtual size: 287KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB