519a1f979d1977e9f7425546b3288759bdef454168f8401fd800e8219a6ce715

Sharing

Copy URL

Twitter E-mail

General

Target

519a1f979d1977e9f7425546b3288759bdef454168f8401fd800e8219a6ce715
Size

6.5MB
MD5

0b6a188d0238a5d415f5deae50e9cb9d
SHA1

a7cdb924761b80ee4da243b0dbb0a0c50c365e73
SHA256

519a1f979d1977e9f7425546b3288759bdef454168f8401fd800e8219a6ce715
SHA512

1f952525792b85f9a5d7a79981c687c14f1dc873189f094e3f65de23649cfa2382940774ec1a33c21e0435462734a284523da55f3dc3f43891bcc44875d90b31
SSDEEP

196608:o2s/Kp9E8hz6syk2g37WVfB1gSiZ+RtxnHVN333VtQx1Si:oBy3Nhz/dp7Whr+Z+ZD3HVtIH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
519a1f979d1977e9f7425546b3288759bdef454168f8401fd800e8219a6ce715

Files

519a1f979d1977e9f7425546b3288759bdef454168f8401fd800e8219a6ce715
.dll windows:6 windows x64

45fafc7db02938bf30577d4af3b4f696

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetLastError
GetModuleFileNameW
CloseHandle
CreateFileW
ReadFile
GetLocalTime
GetFileSize
GetFileInformationByHandle
FileTimeToSystemTime
CopyFileA
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
SetEndOfFile
WriteConsoleW
UnmapViewOfFile
SetFilePointer
WriteFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
CreateDirectoryA
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
WideCharToMultiByte
GetModuleFileNameA
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetFileAttributesA
WaitForSingleObjectEx
Sleep
SwitchToThread
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
MultiByteToWideChar
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateDirectoryW
LocalAlloc
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
SystemTimeToFileTime
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetModuleHandleExW
ExitProcess
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
MoveFileExW
HeapReAlloc
FindFirstFileExW
FindNextFileW
IsValidCodePage
RtlUnwind
GetVersionExW

user32

wsprintfW
GetDesktopWindow

advapi32

CredDeleteW
RegCreateKeyExA
CredWriteW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExA

shell32

SHGetSpecialFolderPathA
SHCreateDirectoryExA

oleaut32

VariantClear
SysAllocString
SysFreeString

shlwapi

PathFileExistsA
PathFileExistsW

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

libcrypto-1_1-x64

MD5_Final
AES_set_encrypt_key
AES_cbc_encrypt
AES_set_decrypt_key
MD5_Update
MD5_Init
SHA256_Final
SHA256_Update
SHA256_Init

crypt32

CertGetNameStringW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgClose
CertCloseStore
CryptQueryObject

ole32

CoCreateGuid
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize

Exports

Exports

ClearKeytarLegacy
DecryptData
DecryptUserInfo
EncryptData
EncryptUserInfo
RemoveData
RemoveExtra
RemoveUserInfo
SetDebugMode
SetLogPath
SetStoragePath

Sections

.text
Size: 488KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lr30
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lr31
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 721B - Virtual size: 721B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

45fafc7db02938bf30577d4af3b4f696

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

iphlpapi

libcrypto-1_1-x64

crypt32

ole32

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 488KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 28KB - Virtual size: 28KB

.pdata Size: 28KB - Virtual size: 28KB

_RDATA Size: 4KB - Virtual size: 4KB

.lr30 Size: 1.9MB - Virtual size: 1.9MB

.lr31 Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 721B - Virtual size: 721B

.l1 Size: 9KB - Virtual size: 9KB

.text
Size: 488KB - Virtual size: 488KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 28KB - Virtual size: 28KB

.pdata
Size: 28KB - Virtual size: 28KB

_RDATA
Size: 4KB - Virtual size: 4KB

.lr30
Size: 1.9MB - Virtual size: 1.9MB

.lr31
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 721B - Virtual size: 721B

.l1
Size: 9KB - Virtual size: 9KB