349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47

Sharing

Copy URL

Twitter E-mail

General

Target

349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47
Size

5.9MB
MD5

a8d100b18a92e88834aa6b087007ea9f
SHA1

79214374fdb5192b7640a10987c19420ea92e4f4
SHA256

349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47
SHA512

9072f84f7555625d94e1267304feca313a2ebc4f4da61f136d571888960fef071e89192251179b2edc1d8d04d47dd9ab45fc5fa150654ca285e433e33d7ed968
SSDEEP

98304:53fFwyocjW+wBOJVurVxn4MACVVYxlOfz/2CU/CaypmCB0olEwOg1u1/9vk:QtcMDVtzYl4/2taayfBVlZOt1l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47

Files

349918d7af027a760b0a7775251875b011bd07a803f3ea09bf44dc6d578b6a47
.dll windows:5 windows x86

1a1c9bbffc2bdc17692f18a069dbc790

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
InterlockedExchange
CompareStringA
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
InterlockedIncrement
GlobalFlags
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentDirectoryW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
HeapAlloc
RtlUnwind
RaiseException
HeapReAlloc
ExitThread
WaitForMultipleObjects
SetStdHandle
GetFileType
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GlobalAddAtomW
GlobalFindAtomW
GetVersionExW
CompareStringW
lstrcmpW
ReleaseMutex
CreateMutexW
ExitProcess
OpenEventW
GetNativeSystemInfo
SetLocalTime
ResetEvent
GetVersionExA
GetFileTime
GetFileSizeEx
GetFileAttributesW
CreateFileW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
FreeResource
FreeLibrary
InterlockedDecrement
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
OpenFileMappingW
GetFileSize
SetEndOfFile
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
VirtualFreeEx
WriteProcessMemory
GetComputerNameA
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
SetLastError
GetLastError
OutputDebugStringA
FormatMessageA
CreateProcessA
CreatePipe
GetExitCodeProcess
MoveFileA
GetFileAttributesA
GetSystemInfo
FindClose
DeleteFileW
FindFirstFileW
lstrcmpA
GetTickCount
VirtualFree
CreateRemoteThread
VirtualAlloc
VirtualAllocEx
LoadLibraryA
GlobalFindAtomA
lstrlenW
lstrcpyA
Process32NextW
OpenProcess
Process32FirstW
UnmapViewOfFile
MapViewOfFile
GetWindowsDirectoryW
TerminateProcess
lstrcatA
GetModuleFileNameA
GlobalDeleteAtom
SetThreadPriority
lstrcmpiW
GetCurrentThreadId
lstrlenA
GetCurrentThread
LocalFree
FormatMessageW
WideCharToMultiByte
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
ResumeThread
Wow64SetThreadContext
Wow64GetThreadContext
SuspendThread
OpenThread
SetProcessWorkingSetSize
GetCurrentProcess
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
Sleep
GetCurrentProcessId
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
IsBadReadPtr
VirtualProtect
GetModuleHandleW
lstrcatW
GetModuleFileNameW
CloseHandle
SetEvent
CreateEventW
LCMapStringA
lstrcpyW
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DestroyMenu
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetDC
ReleaseDC
GetSysColorBrush
UnregisterClassW
SetCursor
PostQuitMessage
CharUpperW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadIconW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
RegisterWindowMessageW
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
wsprintfW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
SetWindowsHookExW
CallNextHookEx
TranslateMessage
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
SetWindowLongW
GetDlgCtrlID
IsDialogMessageW
SendDlgItemMessageW
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetWindowTextW
EnableWindow
SendMessageTimeoutW
PostThreadMessageW
SetWindowTextA
GetClassNameW
CreateWindowExA
DispatchMessageW
GetMessageW
GetWindowThreadProcessId
GetAsyncKeyState
SetTimer
ShowWindow
SendMessageW
IsWindowVisible
UpdateWindow
CharUpperBuffW
MessageBoxW

gdi32

OffsetViewportOrgEx
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
SetMapMode
GetDeviceCaps
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
SaveDC
RestoreDC
SetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW

shlwapi

PathFileExistsA
PathRemoveFileSpecW
PathRemoveFileSpecA
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFileExistsW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

ws2_32

WSARecv
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSASend
WSASocketW
WSAResetEvent
WSACreateEvent
WSACloseEvent

psapi

GetMappedFileNameA
GetProcessMemoryInfo

iphlpapi

GetIfEntry
GetAdaptersInfo

wtsapi32

WTSSendMessageW

Exports

Exports

GetDllVersion
InjectToProcess

Sections

.text
Size: 628KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1a1c9bbffc2bdc17692f18a069dbc790

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

psapi

iphlpapi

wtsapi32

Exports

Exports

Sections

.text Size: 628KB - Virtual size: 628KB

.rdata Size: 164KB - Virtual size: 164KB

.data Size: 120KB - Virtual size: 120KB

.Shared Size: 4KB - Virtual size: 4KB

.text0 Size: 2.3MB - Virtual size: 2.3MB

.text1 Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.l1 Size: 21KB - Virtual size: 21KB

.text
Size: 628KB - Virtual size: 628KB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 120KB - Virtual size: 120KB

.Shared
Size: 4KB - Virtual size: 4KB

.text0
Size: 2.3MB - Virtual size: 2.3MB

.text1
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.l1
Size: 21KB - Virtual size: 21KB