63d7c9127b16b0fc20551f40dfa846bc5e7d69f87f8d3d52079f8304ecbaf5fc

Sharing

Copy URL Twitter E-mail

General

Target

63d7c9127b16b0fc20551f40dfa846bc5e7d69f87f8d3d52079f8304ecbaf5fc
Size

2.3MB
MD5

1dac923d69fe8a7d11b7b50282d63418
SHA1

9b417223835fe10e1f99543955f6cee299e86786
SHA256

63d7c9127b16b0fc20551f40dfa846bc5e7d69f87f8d3d52079f8304ecbaf5fc
SHA512

0b06ca2ebf205133f12bb9e1c0f39d691b40a02e93fbd1c52ff3dba3080a5d17f27f75ced86cc1a19f36f83fcd7d42d967fe443d16d4439918ac2c8e433020a0
SSDEEP

49152:dYPX4UrNpvSq5/ArNxQq/Np8t3UG6bT0pCUOKvWu89fFL1jymYh:dmXRpvSqyrNWqIhHXvWueffy7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63d7c9127b16b0fc20551f40dfa846bc5e7d69f87f8d3d52079f8304ecbaf5fc

Files

63d7c9127b16b0fc20551f40dfa846bc5e7d69f87f8d3d52079f8304ecbaf5fc
.dll windows x86

fb69097abe05d56dd8723dc7f6adffb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
WriteFile
WaitForSingleObject
CreateProcessA
GetStartupInfoA
ReadFile
GetFileSize
GetVersionExA
DeleteFileA
Sleep
GetPrivateProfileStringA
WritePrivateProfileStringA
GetLocalTime
GlobalSize
GetModuleFileNameA
ExitProcess
GetProcAddress
LoadLibraryA
LCMapStringA
lstrcpyA
lstrlenA
PostQueuedCompletionStatus
CreateIoCompletionPort
GetLastError
GetSystemInfo
GetQueuedCompletionStatus
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
lstrcpyn
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleHandleA
GetProcessHeap
lstrcpynA
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
MultiByteToWideChar
FreeLibrary
GlobalFree
RtlMoveMemory
DeviceIoControl
CreateFileA
OpenProcess
GetCommandLineA
VirtualProtect
lstrcatA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxTimeoutA
wvsprintfA
wsprintfA
MessageBoxA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
ReleaseDC
GetDC
GetWindowRect
GetDesktopWindow

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
GetObjectA
GetDIBits
DeleteDC
DeleteObject

advapi32

CryptHashData
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptCreateHash

ws2_32

gethostbyname
WSACleanup
inet_ntoa
WSAStartup
recv
connect
WSASend
WSARecv
setsockopt
WSAIoctl
WSASocketA
inet_addr
htons
closesocket
WSAGetLastError
getpeername
listen
bind
send

gdiplus

GdiplusStartup
GdipCreateBitmapFromStream
GdipSaveImageToStream
GdipDisposeImage

shlwapi

PathMatchSpecA
PathFileExistsA
StrToIntExA

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream
CLSIDFromString

psapi

GetModuleFileNameExA

msvcrt

_beginthreadex
floor
strncmp
memmove
strncpy
realloc
modf
strchr
strrchr
rand
atoi
_ftol
srand
sprintf
free
malloc
__CxxFrameHandler
??3@YAXPAX@Z
_CIfmod
??2@YAPAXI@Z

Exports

Exports

DCIBeginAccess
DCICloseProvider
DCICreateOffscreen
DCICreateOverlay
DCICreatePrimary
DCIDestroy
DCIDraw
DCIEndAccess
DCIEnum
DCIOpenProvider
DCISetClipList
DCISetDestination
DCISetSrcDestClip
GetDCRegionData
GetGameData
GetWindowRegionData
Init
ProtocolCoreEx
WinWatchClose
WinWatchDidStatusChange
WinWatchGetClipList
WinWatchNotify
WinWatchOpen

Sections

.text
Size: - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vip0
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vip1
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb69097abe05d56dd8723dc7f6adffb3

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

gdiplus

shlwapi

ole32

psapi

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 121KB

.rdata Size: - Virtual size: 4KB

.data Size: - Virtual size: 2.0MB

.vip0 Size: - Virtual size: 38KB

.vip1 Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 4KB - Virtual size: 184B

.rsrc Size: 4KB - Virtual size: 692B

.text
Size: - Virtual size: 121KB

.rdata
Size: - Virtual size: 4KB

.data
Size: - Virtual size: 2.0MB

.vip0
Size: - Virtual size: 38KB

.vip1
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 4KB - Virtual size: 184B

.rsrc
Size: 4KB - Virtual size: 692B