af9b6e590279e8197ce3c657f7a8e271e7caf0f2e022209161dca44bd12eb0ef

Sharing

Copy URL Twitter E-mail

General

Target

af9b6e590279e8197ce3c657f7a8e271e7caf0f2e022209161dca44bd12eb0ef
Size

386KB
MD5

59f46c2feaa51d993c3a4fea91a12edb
SHA1

763f3a5db43c1788c7af3cc1ec5dc0859ac4b223
SHA256

af9b6e590279e8197ce3c657f7a8e271e7caf0f2e022209161dca44bd12eb0ef
SHA512

311999b611552badb2d543a853f0c6f20732817776406040aefec25336f5341f9f9f2f811114248062b8e7868f7bb83a682b532ff88bafa11a00c08f85195c5d
SSDEEP

6144:3XCFtAyBfkb+tbkEofUhA2eQH3XT7Cx+fYqCeYcSZKvnvAseqWR:nDyuEhjeQH3XTexMgaSsveqWR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af9b6e590279e8197ce3c657f7a8e271e7caf0f2e022209161dca44bd12eb0ef

Files

af9b6e590279e8197ce3c657f7a8e271e7caf0f2e022209161dca44bd12eb0ef
.dll windows x86

19939730af3d20c0569342d340d4b043

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleacc

AccessibleObjectFromWindow
AccessibleChildren

kernel32

DecodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcessId
CreateEventW
GetLogicalDriveStringsW
DeviceIoControl
QueryDosDeviceW
GetEnvironmentVariableW
GetModuleHandleA
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateDirectoryW
SetFileAttributesW
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
GlobalSize
GetCurrentDirectoryW
OutputDebugStringA
LoadLibraryA
GetTempFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
FreeLibrary
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetProcAddress
CreateFileW
GetModuleHandleW
SetLastError
VirtualQuery
GetLastError
MultiByteToWideChar
LocalFree
CreateFileA
GetTempPathW
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetCommandLineW
ReadFile
GetFileSize
CloseHandle
WideCharToMultiByte
GetCurrentThread
DeleteFileW
SetEndOfFile
GetConsoleCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
VirtualProtect
FindFirstFileExA
FindClose
RaiseException
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
LCMapStringW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetStringTypeW
GetACP
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
LoadLibraryW
GetFileAttributesW
InterlockedIncrement
CreateSemaphoreW
GetTickCount
InterlockedCompareExchange
InterlockedDecrement
WaitForSingleObject
OpenMutexW
ReleaseSemaphore
GetDriveTypeW
InterlockedExchange
GetVersion
LocalAlloc
InitializeCriticalSection
UnmapViewOfFile
ReleaseMutex
DuplicateHandle
OpenProcess
Sleep
MapViewOfFile
CreateFileMappingW
lstrcpyA
lstrlenA
SetEvent
lstrcatA
WaitForMultipleObjects
CreateMutexW
GetVersionExW
OpenFileMappingW
OpenEventW
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
ExitProcess
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileAttributesExW

user32

GetClassNameW
SetWindowLongW
MessageBoxA
GetForegroundWindow
GetWindowLongW
wsprintfW
GetDC
ReleaseDC
GetClipboardFormatNameW
GetWindowThreadProcessId
FindWindowW
FindWindowExW
SendMessageW
GetWindowTextW
UnhookWindowsHookEx
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
SetWindowsHookExW
GetParent
CallNextHookEx
GetCapture
CallWindowProcW
GetKeyState
MessageBoxW
ClientToScreen
GetClientRect
LoadImageW
GetClipboardData
GetClipboardSequenceNumber

advapi32

RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

ole32

CoCreateInstance
RegisterDragDrop
CoUninitialize
CoInitialize
CoTaskMemFree
RevokeDragDrop
ReleaseStgMedium
CoCreateGuid

shell32

SHGetFolderPathW
DragQueryFileW
SHGetPathFromIDListW
CommandLineToArgvW

oleaut32

SysFreeString
VariantInit

shlwapi

PathIsDirectoryW
PathFindFileNameW
PathAppendA
PathAppendW
PathRemoveFileSpecW
PathIsNetworkPathW
PathRemoveFileSpecA
PathIsDirectoryA
PathFileExistsW

gdi32

GetFontUnicodeRanges
AbortDoc
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectW
DeleteDC
GetDeviceCaps
CreateDCW
GetGlyphIndicesW

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19939730af3d20c0569342d340d4b043

Headers

DLL Characteristics

File Characteristics

Imports

version

oleacc

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

Sections

.text Size: 260KB - Virtual size: 260KB

.rdata Size: 65KB - Virtual size: 65KB

.data Size: 38KB - Virtual size: 2.0MB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 260KB - Virtual size: 260KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 38KB - Virtual size: 2.0MB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB