6b43b9af54c6d03f09af136120a083a0d4a701a63cfd9dd77a9cd649238e9b13

Sharing

Copy URL

Twitter E-mail

General

Target

6b43b9af54c6d03f09af136120a083a0d4a701a63cfd9dd77a9cd649238e9b13
Size

2.6MB
MD5

7b6521132b6a7cd59d95ed8f6f0d0b22
SHA1

13f8505adc5c7343ad4dab9324a04178dd02d2ea
SHA256

6b43b9af54c6d03f09af136120a083a0d4a701a63cfd9dd77a9cd649238e9b13
SHA512

7de3876dfa1f33f2f773d606e8109c8ea2b91f91244113701c988e613fd35e35430fdf49d9624cdbc25af3e418c7360653e9a7a1600282afb231ef0a9f9f5ceb
SSDEEP

49152:jMVf3iOccCqHXylDwTjGB0zkMZR0HPco2n2xOU4Y1u1BNd71NFpcOk:jU/CaypmCB0olEwOg1u1/9vk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b43b9af54c6d03f09af136120a083a0d4a701a63cfd9dd77a9cd649238e9b13

Files

6b43b9af54c6d03f09af136120a083a0d4a701a63cfd9dd77a9cd649238e9b13
.dll windows:5 windows x86

4210b1802bfd8173995a8b8e72ad0c09

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
InterlockedExchange
CompareStringA
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
InterlockedIncrement
GlobalFlags
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentDirectoryW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
HeapAlloc
RtlUnwind
RaiseException
HeapReAlloc
ExitThread
WaitForMultipleObjects
SetStdHandle
GetFileType
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GlobalAddAtomW
GlobalFindAtomW
GetVersionExW
CompareStringW
lstrcmpW
ReleaseMutex
CreateMutexW
ExitProcess
OpenEventW
GetNativeSystemInfo
SetLocalTime
ResetEvent
GetVersionExA
GetFileTime
GetFileSizeEx
GetFileAttributesW
CreateFileW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
FreeResource
FreeLibrary
InterlockedDecrement
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
OpenFileMappingW
GetFileSize
SetEndOfFile
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
VirtualFreeEx
WriteProcessMemory
GetComputerNameA
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
SetLastError
GetLastError
OutputDebugStringA
FormatMessageA
CreateProcessA
CreatePipe
GetExitCodeProcess
MoveFileA
GetFileAttributesA
GetSystemInfo
FindClose
DeleteFileW
FindFirstFileW
lstrcmpA
GetTickCount
VirtualFree
CreateRemoteThread
VirtualAlloc
VirtualAllocEx
LoadLibraryA
GlobalFindAtomA
lstrlenW
lstrcpyA
Process32NextW
OpenProcess
Process32FirstW
UnmapViewOfFile
MapViewOfFile
GetWindowsDirectoryW
TerminateProcess
lstrcatA
GetModuleFileNameA
GlobalDeleteAtom
SetThreadPriority
lstrcmpiW
GetCurrentThreadId
lstrlenA
GetCurrentThread
LocalFree
FormatMessageW
WideCharToMultiByte
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
ResumeThread
Wow64SetThreadContext
Wow64GetThreadContext
SuspendThread
OpenThread
SetProcessWorkingSetSize
GetCurrentProcess
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
Sleep
GetCurrentProcessId
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
IsBadReadPtr
VirtualProtect
GetModuleHandleW
lstrcatW
GetModuleFileNameW
CloseHandle
SetEvent
CreateEventW
LCMapStringA
lstrcpyW
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

DestroyMenu
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetDC
ReleaseDC
GetSysColorBrush
UnregisterClassW
SetCursor
PostQuitMessage
CharUpperW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadIconW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
RegisterWindowMessageW
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
wsprintfW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
SetWindowsHookExW
CallNextHookEx
TranslateMessage
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
SetWindowLongW
GetDlgCtrlID
IsDialogMessageW
SendDlgItemMessageW
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetWindowTextW
EnableWindow
SendMessageTimeoutW
PostThreadMessageW
SetWindowTextA
GetClassNameW
CreateWindowExA
DispatchMessageW
GetMessageW
GetWindowThreadProcessId
GetAsyncKeyState
SetTimer
ShowWindow
SendMessageW
IsWindowVisible
UpdateWindow
CharUpperBuffW
MessageBoxW

gdi32

OffsetViewportOrgEx
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
SetMapMode
GetDeviceCaps
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
SaveDC
RestoreDC
SetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW

shlwapi

PathFileExistsA
PathRemoveFileSpecW
PathRemoveFileSpecA
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFileExistsW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VariantChangeType
VariantInit
VariantTimeToSystemTime
SystemTimeToVariantTime

ws2_32

htons
inet_addr
WSAGetLastError
closesocket
WSASetLastError
connect
gethostbyname
WSACleanup
WSARecv
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSASend
shutdown
WSASocketW
WSAResetEvent
WSACreateEvent
WSACloseEvent
gethostname
WSAStartup
inet_ntoa

psapi

GetMappedFileNameA
GetProcessMemoryInfo

iphlpapi

GetIfEntry
GetAdaptersInfo

wtsapi32

WTSSendMessageW

Exports

Exports

GetDllVersion
InjectToProcess

Sections

.text
Size: - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4210b1802bfd8173995a8b8e72ad0c09

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

psapi

iphlpapi

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 626KB

.rdata Size: - Virtual size: 160KB

.data Size: - Virtual size: 118KB

.Shared Size: 1024B - Virtual size: 520B

.text0 Size: - Virtual size: 2.3MB

.text1 Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 512B - Virtual size: 320B

.rsrc Size: 4KB - Virtual size: 27KB

.text
Size: - Virtual size: 626KB

.rdata
Size: - Virtual size: 160KB

.data
Size: - Virtual size: 118KB

.Shared
Size: 1024B - Virtual size: 520B

.text0
Size: - Virtual size: 2.3MB

.text1
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 512B - Virtual size: 320B

.rsrc
Size: 4KB - Virtual size: 27KB