38c594b7d98376840108622d5cd35d98c491457bc2ceb28d6ca404932cd9662e

Sharing

Copy URL Twitter E-mail

General

Target

38c594b7d98376840108622d5cd35d98c491457bc2ceb28d6ca404932cd9662e
Size

4.9MB
MD5

bc983039c6b4ff2ee88ea574ba6a3868
SHA1

cd000b6cd1b871972d97b40f0cd3c3fd2f1bbbb3
SHA256

38c594b7d98376840108622d5cd35d98c491457bc2ceb28d6ca404932cd9662e
SHA512

101e117a5f4db3a3d41339145060e91e22b945e7af259cfc1c3052664e269816a5663d77ee9ab40457ad15e56c79353146b08929ce575c173a00d450aa589e50
SSDEEP

98304:ZZqRwneuj6UWYMY1hV5hjrvEh09NPH/WKA1rORkzUsxhKjM:2aeSFhjrvEhuFfWymVo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38c594b7d98376840108622d5cd35d98c491457bc2ceb28d6ca404932cd9662e

Files

38c594b7d98376840108622d5cd35d98c491457bc2ceb28d6ca404932cd9662e
.dll windows x86

4db38fe18ffce1bd8f7389ab9fad93e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

connect
WSAGetOverlappedResult
getprotobynumber
getservbyname
htonl
WSASend
WSARecv
shutdown
socket
getnameinfo
gethostname
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
getsockopt
getpeername
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
closesocket
WSAStartup
inet_addr
getsockname
htons

crypt32

CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertGetCertificateChain
CertCreateCertificateContext

wldap32

ord27
ord22
ord50
ord60
ord211
ord46
ord217
ord143
ord26
ord41
ord32
ord301
ord200
ord30
ord79
ord35
ord33

kernel32

FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
RaiseException
InterlockedFlushSList
RtlUnwind
AreFileApisANSI
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
FileTimeToSystemTime
FileTimeToLocalFileTime
ReadFile
GetModuleFileNameA
SizeofResource
FindFirstFileW
MoveFileA
GetFileSizeEx
VirtualFree
FindNextFileW
GetCurrentProcess
WriteFile
VirtualAlloc
GetModuleFileNameW
FindResourceA
FindClose
CreateFileW
FreeResource
OpenProcess
GetFileAttributesA
CreateFileA
LockResource
DeleteFileA
CloseHandle
LoadResource
SetFileAttributesA
GetProcAddress
LocalFree
GetModuleHandleW
GetFileType
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
VirtualProtect
HeapFree
SetLastError
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
Sleep
GetFileInformationByHandle
ExpandEnvironmentStringsA
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateProcessA
GetProcessTimes
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
GetComputerNameA
GetLocalTime
GetModuleHandleA
CreateMutexA
WaitForSingleObject
UnmapViewOfFile
GetExitCodeThread
GetLastError
GetSystemDirectoryA
GetSystemWow64DirectoryA
CreateFileMappingA
WinExec
OpenFileMappingA
CreateDirectoryA
MapViewOfFile
FormatMessageA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SleepEx
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
VerSetConditionMask
VerifyVersionInfoA
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
HeapSize
TlsGetValue
TlsSetValue
TlsFree
FormatMessageW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleExW
LoadLibraryW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
SystemTimeToFileTime
QueryPerformanceFrequency
LocalAlloc
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
CreateSemaphoreA
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SystemTimeToTzSpecificLocalTime
SetFilePointerEx
SetConsoleCtrlHandler
ExitProcess
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
GetFileAttributesExW
SetEndOfFile
OutputDebugStringW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoEx
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
InitOnceExecuteOnce
GetStringTypeW
GetDriveTypeW
GetTickCount
TlsAlloc

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
SetNamedSecurityInfoA
RegSetValueExA
RegOpenKeyExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

shell32

SHCreateDirectoryExA
ShellExecuteExA

ole32

CoInitializeEx

shlwapi

PathRemoveFileSpecA
PathAddBackslashA
StrStrIW

iphlpapi

GetAdaptersInfo
SendARP

Exports

Exports

_dll_run
nghttp2_check_authority
nghttp2_check_header_name
nghttp2_check_header_value
nghttp2_hd_deflate_bound
nghttp2_hd_deflate_change_table_size
nghttp2_hd_deflate_del
nghttp2_hd_deflate_get_dynamic_table_size
nghttp2_hd_deflate_get_max_dynamic_table_size
nghttp2_hd_deflate_get_num_table_entries
nghttp2_hd_deflate_get_table_entry
nghttp2_hd_deflate_hd
nghttp2_hd_deflate_hd_vec
nghttp2_hd_deflate_new
nghttp2_hd_deflate_new2
nghttp2_hd_inflate_change_table_size
nghttp2_hd_inflate_del
nghttp2_hd_inflate_end_headers
nghttp2_hd_inflate_get_dynamic_table_size
nghttp2_hd_inflate_get_max_dynamic_table_size
nghttp2_hd_inflate_get_num_table_entries
nghttp2_hd_inflate_get_table_entry
nghttp2_hd_inflate_hd
nghttp2_hd_inflate_hd2
nghttp2_hd_inflate_new
nghttp2_hd_inflate_new2
nghttp2_http2_strerror
nghttp2_is_fatal
nghttp2_nv_compare_name
nghttp2_pack_settings_payload
nghttp2_priority_spec_check_default
nghttp2_priority_spec_default_init
nghttp2_priority_spec_init
nghttp2_rcbuf_decref
nghttp2_rcbuf_get_buf
nghttp2_rcbuf_incref
nghttp2_rcbuf_is_static
nghttp2_session_callbacks_del
nghttp2_session_callbacks_new
nghttp2_session_callbacks_set_before_frame_send_callback
nghttp2_session_callbacks_set_data_source_read_length_callback
nghttp2_session_callbacks_set_error_callback
nghttp2_session_callbacks_set_error_callback2
nghttp2_session_callbacks_set_on_begin_frame_callback
nghttp2_session_callbacks_set_on_begin_headers_callback
nghttp2_session_callbacks_set_on_data_chunk_recv_callback
nghttp2_session_callbacks_set_on_extension_chunk_recv_callback
nghttp2_session_callbacks_set_on_frame_not_send_callback
nghttp2_session_callbacks_set_on_frame_recv_callback
nghttp2_session_callbacks_set_on_frame_send_callback
nghttp2_session_callbacks_set_on_header_callback
nghttp2_session_callbacks_set_on_header_callback2
nghttp2_session_callbacks_set_on_invalid_frame_recv_callback
nghttp2_session_callbacks_set_on_invalid_header_callback
nghttp2_session_callbacks_set_on_invalid_header_callback2
nghttp2_session_callbacks_set_on_stream_close_callback
nghttp2_session_callbacks_set_pack_extension_callback
nghttp2_session_callbacks_set_recv_callback
nghttp2_session_callbacks_set_select_padding_callback
nghttp2_session_callbacks_set_send_callback
nghttp2_session_callbacks_set_send_data_callback
nghttp2_session_callbacks_set_unpack_extension_callback
nghttp2_session_change_stream_priority
nghttp2_session_check_request_allowed
nghttp2_session_check_server_session
nghttp2_session_client_new
nghttp2_session_client_new2
nghttp2_session_client_new3
nghttp2_session_consume
nghttp2_session_consume_connection
nghttp2_session_consume_stream
nghttp2_session_create_idle_stream
nghttp2_session_del
nghttp2_session_find_stream
nghttp2_session_get_effective_local_window_size
nghttp2_session_get_effective_recv_data_length
nghttp2_session_get_hd_deflate_dynamic_table_size
nghttp2_session_get_hd_inflate_dynamic_table_size
nghttp2_session_get_last_proc_stream_id
nghttp2_session_get_local_settings
nghttp2_session_get_local_window_size
nghttp2_session_get_next_stream_id
nghttp2_session_get_outbound_queue_size
nghttp2_session_get_remote_settings
nghttp2_session_get_remote_window_size
nghttp2_session_get_root_stream
nghttp2_session_get_stream_effective_local_window_size
nghttp2_session_get_stream_effective_recv_data_length
nghttp2_session_get_stream_local_close
nghttp2_session_get_stream_local_window_size
nghttp2_session_get_stream_remote_close
nghttp2_session_get_stream_remote_window_size
nghttp2_session_get_stream_user_data
nghttp2_session_mem_recv
nghttp2_session_mem_send
nghttp2_session_recv
nghttp2_session_resume_data
nghttp2_session_send
nghttp2_session_server_new
nghttp2_session_server_new2
nghttp2_session_server_new3
nghttp2_session_set_local_window_size
nghttp2_session_set_next_stream_id
nghttp2_session_set_stream_user_data
nghttp2_session_set_user_data
nghttp2_session_terminate_session
nghttp2_session_terminate_session2
nghttp2_session_upgrade
nghttp2_session_upgrade2
nghttp2_session_want_read
nghttp2_session_want_write
nghttp2_stream_get_first_child
nghttp2_stream_get_next_sibling
nghttp2_stream_get_parent
nghttp2_stream_get_previous_sibling
nghttp2_stream_get_state
nghttp2_stream_get_stream_id
nghttp2_stream_get_sum_dependency_weight
nghttp2_stream_get_weight
nghttp2_strerror
nghttp2_submit_altsvc
nghttp2_submit_data
nghttp2_submit_extension
nghttp2_submit_goaway
nghttp2_submit_headers
nghttp2_submit_origin
nghttp2_submit_ping
nghttp2_submit_priority
nghttp2_submit_push_promise
nghttp2_submit_request
nghttp2_submit_response
nghttp2_submit_rst_stream
nghttp2_submit_settings
nghttp2_submit_shutdown_notice
nghttp2_submit_trailer
nghttp2_submit_window_update
nghttp2_version

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 622KB - Virtual size: 622KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 731KB - Virtual size: 731KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4db38fe18ffce1bd8f7389ab9fad93e1

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wldap32

kernel32

user32

advapi32

shell32

ole32

shlwapi

iphlpapi

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 622KB - Virtual size: 622KB

.data Size: 27KB - Virtual size: 43KB

.vmp0 Size: 731KB - Virtual size: 731KB

.reloc Size: 91KB - Virtual size: 91KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 622KB - Virtual size: 622KB

.data
Size: 27KB - Virtual size: 43KB

.vmp0
Size: 731KB - Virtual size: 731KB

.reloc
Size: 91KB - Virtual size: 91KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB