4598e58826c08c85b793d94a07e936344d2f88b322143188be299a01c3d0b3d1

Sharing

Copy URL Twitter E-mail

General

Target

4598e58826c08c85b793d94a07e936344d2f88b322143188be299a01c3d0b3d1
Size

2.2MB
MD5

ecc041ac48d9092880b2de4e29f39477
SHA1

0be81bb411b0292fc4b4616bdd62f02755caa2bc
SHA256

4598e58826c08c85b793d94a07e936344d2f88b322143188be299a01c3d0b3d1
SHA512

f0f556a3ae382547596f2f47db48374ff2169363f0acbd7151e752baab6883ac086ad2765e543b5e538ffa288807e35a621512ab2b0ce91f01e1a25afa73f89f
SSDEEP

49152:SX7aAyJBC2d+wliw5QJatP/8xpTGRHBQp72O:SX7xyzd+wd5MaF82

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4598e58826c08c85b793d94a07e936344d2f88b322143188be299a01c3d0b3d1

Files

4598e58826c08c85b793d94a07e936344d2f88b322143188be299a01c3d0b3d1
.dll regsvr32 windows:6 windows x86

57113fe8744060ca2f12452a5f6a41f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFileTime
GetFileType
GetFileInformationByHandle
GetFileInformationByHandleEx
FreeResource
GetSystemInfo
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
GetDateFormatEx
GetTimeFormatEx
QueryPerformanceCounter
GetCurrentDirectoryW
CancelIo
GetUserPreferredUILanguages
GetLocaleInfoEx
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
GetFullPathNameW
OpenMutexW
GetEnvironmentVariableW
SetFileInformationByHandle
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
SetFileAttributesW
GetProcAddress
LoadLibraryA
GetModuleHandleA
CopyFileW
SetEndOfFile
SetFilePointer
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
WriteConsoleW
FindFirstFileExW
GetFinalPathNameByHandleW
ReplaceFileW
SetFileValidData
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetStdHandle
GetConsoleOutputCP
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
ReadFile
SetLastError
LocalFree
GetCurrentThreadId
GetLastError
DeleteFileW
MoveFileExW
CreateDirectoryW
GetCurrentProcessId
FreeLibrary
LoadLibraryW
GetModuleFileNameW
VerifyVersionInfoW
VerSetConditionMask
WriteFile
SetNamedPipeHandleState
CreateFileW
Sleep
CloseHandle
CreateProcessW
GetModuleHandleExW
lstrcpynW
lstrcpynA
GetFileAttributesW
LoadResource
LockResource
FindResourceW
SizeofResource
HeapAlloc
HeapFree
PeekNamedPipe
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStdHandle
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
DeleteFiber
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetStringTypeW
WakeAllConditionVariable
SleepConditionVariableSRW

user32

GetSystemMetrics
InsertMenuW
SetMenuInfo
SetMenuItemInfoW
CreateIconIndirect
ReleaseDC
GetDC
DestroyIcon
GetProcessWindowStation
GetIconInfo
GetUserObjectInformationW
LoadImageW
MessageBoxW

gdi32

DeleteDC
PatBlt
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteObject
CreateBitmap

ws2_32

recv
send
closesocket
WSAStartup
WSAGetLastError
WSASetLastError
WSACleanup
htonl
inet_ntop
ntohl

shell32

ord727
DuplicateIcon
SHChangeNotify
SHGetSpecialFolderPathW
DragQueryFileW
SHGetFileInfoW
SHGetStockIconInfo

advapi32

GetAce
CryptSignHashW
CryptDestroyHash
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
GetUserNameW
GetSecurityInfo
SetSecurityDescriptorControl
DeleteAce
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptCreateHash
EqualSid
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptEnumProvidersW

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

gdiplus

GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipDrawArcI
GdipDrawEllipseI
GdipFillEllipseI
GdipCloneBitmapAreaI
GdiplusStartup

shlwapi

PathFindExtensionW

mpr

WNetGetUniversalNameW

ntdll

RtlFreeHeap
RtlAllocateHeap

ncrypt

BCryptGenRandom

Exports

Exports

DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
GetExtVersion

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57113fe8744060ca2f12452a5f6a41f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

shell32

advapi32

crypt32

gdiplus

shlwapi

mpr

ntdll

ncrypt

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 424KB - Virtual size: 424KB

.data Size: 16KB - Virtual size: 62KB

.rsrc Size: 376KB - Virtual size: 376KB

.reloc Size: 56KB - Virtual size: 55KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 424KB - Virtual size: 424KB

.data
Size: 16KB - Virtual size: 62KB

.rsrc
Size: 376KB - Virtual size: 376KB

.reloc
Size: 56KB - Virtual size: 55KB