8c7734f73bfa817ac2466cff42cd63f7de29a90b331b9b703b4d6bf94c3c6a6c

Sharing

Copy URL Twitter E-mail

General

Target

8c7734f73bfa817ac2466cff42cd63f7de29a90b331b9b703b4d6bf94c3c6a6c
Size

386KB
MD5

c0389eaa5a61badf226b8611d2e1e027
SHA1

6cefe3098e025e8e205f46e0244ea3bb90d9f85d
SHA256

8c7734f73bfa817ac2466cff42cd63f7de29a90b331b9b703b4d6bf94c3c6a6c
SHA512

dbe768166b3e269e6e306b25a823deaab6e074664abf0c23b26f6ea910de9340a249e6aceb48187193831505b57f1e8388d1bb6415d7cdfffa6f399e0c35e928
SSDEEP

3072:zR1g2br54Qun9UItLpCEcbqGpYl7WUCJMABezln6:bgI6QkUIcbpO5zx6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c7734f73bfa817ac2466cff42cd63f7de29a90b331b9b703b4d6bf94c3c6a6c

Files

8c7734f73bfa817ac2466cff42cd63f7de29a90b331b9b703b4d6bf94c3c6a6c
.dll windows:6 windows x86

c28e2de1ed3b463544cb88cc19089419

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFilePointer
GetFileInformationByHandle
GetTempPathA
CreateFileA
DeleteFileA
FileTimeToLocalFileTime
WideCharToMultiByte
GetTempFileNameA
FileTimeToDosDateTime
HeapCreate
HeapAlloc
HeapDestroy
CreateDirectoryW
TerminateProcess
RemoveDirectoryW
CreateFileW
ResumeThread
DeleteFileW
CreateProcessW
CopyFileW
GetFileAttributesW
LoadLibraryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetStartupInfoW
WaitForDebugEvent
InitializeProcThreadAttributeList
ContinueDebugEvent
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
TerminateThread
CreateThread
SetThreadPriority
VirtualFree
GetCurrentProcess
LocalAlloc
GetCurrentThreadId
SetEvent
LocalFree
DecodePointer
RaiseException
FreeLibrary
SetFilePointerEx
GetConsoleMode
FindClose
FindNextFileW
ReadFile
GetProcAddress
WriteConsoleW
Sleep
GetStdHandle
CloseHandle
GetLastError
CreateEventW
WaitForSingleObject
SetLastError
GetModuleFileNameW
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetProcessHeap
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualQuery
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
lstrlenW
GetCommandLineW
GetModuleHandleW
LoadLibraryExW
InterlockedFlushSList
VirtualAlloc

user32

GetUserObjectInformationW
SendMessageTimeoutW
GetThreadDesktop
CharPrevW
GetProcessWindowStation

advapi32

RegCloseKey
QueryServiceStatusEx
RegSetKeyValueW
CreateWellKnownSid
RegFlushKey
RegEnumKeyExW
RegOpenKeyW
CreateProcessAsUserW
RegDeleteKeyW
RegCreateKeyW
CloseServiceHandle
OpenSCManagerW
RegCreateKeyExW
RegSetValueExW
StartServiceW
RegOpenKeyExW
RegDeleteValueW
OpenServiceW

shell32

SHAssocEnumHandlersForProtocolByApplication
SHCreateItemFromParsingName
SHGetKnownFolderPath
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoCreateInstance
CoUninitialize
CoGetObject
CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoInitializeEx

oleaut32

VariantInit
SysFreeString
SysAllocString

rpcrt4

RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcRaiseException
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcBindingFree
NdrAsyncClientCall

ntdll

RtlGetVersion
RtlWow64EnableFsRedirectionEx
NtFsControlFile
RtlGetCurrentPeb
NtCreatePrivateNamespace
NtDeletePrivateNamespace
RtlFreeHeap
RtlRaiseStatus
RtlSetHeapInformation
RtlCreateHeap
LdrFindEntryForAddress
RtlNtStatusToDosError
RtlImageNtHeader
RtlReleasePebLock
RtlExpandEnvironmentStrings_U
RtlLengthRequiredSid
LdrAccessResource
RtlUnwind
RtlDestroyHeap
NtCreateKey
RtlFormatCurrentUserKeyPath
NtOpenKey
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
NtDeleteFile
NtMapViewOfSection
RtlAddSIDToBoundaryDescriptor
RtlAcquirePebLock
RtlPrefixUnicodeString
RtlAllocateHeap
LdrEnumerateLoadedModules
NtAllocateVirtualMemory
NtQueryInformationToken
NtQueryValueKey
NtUnmapViewOfSection
NtCreateEvent
NtClose
RtlInitUnicodeString
RtlRandomEx
NtCreateSection
RtlComputeCrc32
RtlQueryElevationFlags
NtCompressKey
RtlExitUserProcess
RtlImageDirectoryEntryToData
RtlInitializeSid
NtFreeVirtualMemory
NtDeleteKey
NtNotifyChangeDirectoryFile
NtWaitForSingleObject
NtCreateFile
NtSetEvent
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
NtTerminateProcess
DbgUiSetThreadDebugObject
RtlFreeSid
NtDuplicateObject
RtlLengthSid
RtlAllocateAndInitializeSid
LdrFindResource_U
NtOpenProcess
RtlDeleteBoundaryDescriptor
NtQueryInformationProcess
LdrGetDllHandle
RtlCreateBoundaryDescriptor
RtlSubAuthoritySid
NtQuerySystemInformation
NtSetInformationToken
NtRemoveProcessDebug
NtDeleteValueKey
NtDuplicateToken
NtOpenProcessToken
NtSetValueKey
RtlEqualUnicodeString

comctl32

ord17

cabinet

ord13
ord14
ord11
ord10

msdelta

ApplyDeltaB
DeltaFree

bcrypt

BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptGetProperty

Exports

Exports

run

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c28e2de1ed3b463544cb88cc19089419

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

rpcrt4

ntdll

comctl32

cabinet

msdelta

bcrypt

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 79KB

.rdata Size: 45KB - Virtual size: 44KB

.data Size: 5KB - Virtual size: 8KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 79KB - Virtual size: 79KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 6KB - Virtual size: 5KB