f164f8c556b182166675db76c8b8561ec97b806b1ef57c43e64dbbc58682d60c

Sharing

Copy URL Twitter E-mail

General

Target

f164f8c556b182166675db76c8b8561ec97b806b1ef57c43e64dbbc58682d60c
Size

2.9MB
MD5

11e229d1baa8518e486a1ecc32d64156
SHA1

dc200ec4d9c5d6a0aa3848b4d576cc1e1101c668
SHA256

f164f8c556b182166675db76c8b8561ec97b806b1ef57c43e64dbbc58682d60c
SHA512

6d7d980d615b47d8952c297d8464bda6e4b40701b484495fb4338cced6f9079db216115d41031b6a951f3268379cc4eaa5c69f76cd021c2c1311d2df4e3914a9
SSDEEP

49152:Z6i81UIwOOSu0k3062vxLayqLEDTApC6OEXJLjbVahUdpr:Z6iZB5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f164f8c556b182166675db76c8b8561ec97b806b1ef57c43e64dbbc58682d60c

Files

f164f8c556b182166675db76c8b8561ec97b806b1ef57c43e64dbbc58682d60c
.dll windows:4 windows x86

3006159d3a5389b06f9f15bda4311386

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptImportKey
CryptReleaseContext
CryptSetProvParam
CryptSignHashW
CryptVerifySignatureW
GetUserNameA
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyW
RegDeleteTreeW
RegEnumKeyA
RegEnumKeyExW
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptDestroyKey
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptVerifySignature

kernel32

CloseHandle
CompareFileTime
CreateFileA
CreateFileW
CreateSemaphoreW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FreeLibrary
GetDateFormatA
GetFileSize
GetLocaleInfoA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
HeapAlloc
HeapReAlloc
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
RaiseException
ReadFile
ReleaseSemaphore
ResolveDelayLoadedAPI
RtlUnwind
SetFilePointer
SetFilePointerEx
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpA
lstrcmpiW

ntdll

NtQueryVirtualMemory
RtlNtStatusToDosError
_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf
_assert
_strdup
_stricmp
_strnicmp
_wcsicmp
_wcslwr
_wcsnicmp
free
fwrite
getenv
isspace
iswspace
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strstr
strtol
towlower
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsrchr
wcsstr

user32

CharNextA
LoadStringW
wsprintfW

Exports

Exports

CertAddCRLContextToStore
CertAddCTLContextToStore
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertAddEncodedCRLToStore
CertAddEncodedCTLToStore
CertAddEncodedCertificateToStore
CertAddEncodedCertificateToSystemStoreA
CertAddEncodedCertificateToSystemStoreW
CertAddEnhancedKeyUsageIdentifier
CertAddSerializedElementToStore
CertAddStoreToCollection
CertAlgIdToOID
CertCloseStore
CertCompareCertificate
CertCompareCertificateName
CertCompareIntegerBlob
CertComparePublicKeyInfo
CertControlStore
CertCreateCRLContext
CertCreateCTLContext
CertCreateCertificateChainEngine
CertCreateCertificateContext
CertCreateContext
CertCreateSelfSignCertificate
CertDeleteCRLFromStore
CertDeleteCTLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CertDuplicateCTLContext
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCRLContextProperties
CertEnumCRLsInStore
CertEnumCTLContextProperties
CertEnumCTLsInStore
CertEnumCertificateContextProperties
CertEnumCertificatesInStore
CertEnumPhysicalStore
CertEnumSystemStore
CertFindAttribute
CertFindCRLInStore
CertFindCTLInStore
CertFindCertificateInCRL
CertFindCertificateInStore
CertFindChainInStore
CertFindExtension
CertFindRDNAttr
CertFindSubjectInCTL
CertFreeCRLContext
CertFreeCTLContext
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertGetCTLContextProperty
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetIssuerCertificateFromStore
CertGetNameStringA
CertGetNameStringW
CertGetPublicKeyLength
CertGetStoreProperty
CertGetSubjectCertificateFromStore
CertGetValidUsages
CertIsRDNAttrsInCertificateName
CertIsValidCRLForCertificate
CertNameToStrA
CertNameToStrW
CertOIDToAlgId
CertOpenStore
CertOpenSystemStoreA
CertOpenSystemStoreW
CertRDNValueToStrA
CertRDNValueToStrW
CertRegisterPhysicalStore
CertRegisterSystemStore
CertRemoveEnhancedKeyUsageIdentifier
CertRemoveStoreFromCollection
CertSaveStore
CertSerializeCRLStoreElement
CertSerializeCTLStoreElement
CertSerializeCertificateStoreElement
CertSetCRLContextProperty
CertSetCTLContextProperty
CertSetCertificateContextProperty
CertSetEnhancedKeyUsage
CertSetStoreProperty
CertStrToNameA
CertStrToNameW
CertUnregisterPhysicalStore
CertUnregisterSystemStore
CertVerifyCRLRevocation
CertVerifyCRLTimeValidity
CertVerifyCTLUsage
CertVerifyCertificateChainPolicy
CertVerifyRevocation
CertVerifySubjectCertificateContext
CertVerifyTimeValidity
CertVerifyValidityNesting
CreateFileU
CryptAcquireCertificatePrivateKey
CryptAcquireContextU
CryptBinaryToStringA
CryptBinaryToStringW
CryptCloseAsyncHandle
CryptCreateAsyncHandle
CryptDecodeMessage
CryptDecodeObject
CryptDecodeObjectEx
CryptDecryptAndVerifyMessageSignature
CryptDecryptMessage
CryptEncodeObject
CryptEncodeObjectEx
CryptEncryptMessage
CryptEnumOIDFunction
CryptEnumOIDInfo
CryptEnumProvidersU
CryptExportPKCS8
CryptExportPublicKeyInfo
CryptExportPublicKeyInfoEx
CryptFindCertificateKeyProvInfo
CryptFindLocalizedName
CryptFindOIDInfo
CryptFormatObject
CryptFreeOIDFunctionAddress
CryptGetAsyncParam
CryptGetDefaultOIDDllList
CryptGetDefaultOIDFunctionAddress
CryptGetMessageCertificates
CryptGetMessageSignerCount
CryptGetOIDFunctionAddress
CryptGetOIDFunctionValue
CryptHashCertificate
CryptHashCertificate2
CryptHashMessage
CryptHashPublicKeyInfo
CryptHashToBeSigned
CryptImportPKCS8
CryptImportPublicKeyInfo
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfoEx2
CryptInitOIDFunctionSet
CryptInstallOIDFunctionAddress
CryptLoadSip
CryptMemAlloc
CryptMemFree
CryptMemRealloc
CryptMsgCalculateEncodedLength
CryptMsgClose
CryptMsgControl
CryptMsgCountersign
CryptMsgCountersignEncoded
CryptMsgDuplicate
CryptMsgEncodeAndSignCTL
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgOpenToEncode
CryptMsgSignCTL
CryptMsgUpdate
CryptMsgVerifyCountersignatureEncoded
CryptMsgVerifyCountersignatureEncodedEx
CryptProtectData
CryptProtectMemory
CryptQueryObject
CryptRegisterDefaultOIDFunction
CryptRegisterOIDFunction
CryptRegisterOIDInfo
CryptSIPAddProvider
CryptSIPCreateIndirectData
CryptSIPGetSignedDataMsg
CryptSIPLoad
CryptSIPPutSignedDataMsg
CryptSIPRemoveProvider
CryptSIPRemoveSignedDataMsg
CryptSIPRetrieveSubjectGuid
CryptSIPRetrieveSubjectGuidForCatalogFile
CryptSIPVerifyIndirectData
CryptSetAsyncParam
CryptSetKeyIdentifierProperty
CryptSetOIDFunctionValue
CryptSetProviderU
CryptSignAndEncodeCertificate
CryptSignAndEncryptMessage
CryptSignCertificate
CryptSignHashU
CryptSignMessage
CryptSignMessageWithKey
CryptStringToBinaryA
CryptStringToBinaryW
CryptUnprotectData
CryptUnprotectMemory
CryptUnregisterDefaultOIDFunction
CryptUnregisterOIDFunction
CryptUnregisterOIDInfo
CryptVerifyCertificateSignature
CryptVerifyCertificateSignatureEx
CryptVerifyDetachedMessageHash
CryptVerifyDetachedMessageSignature
CryptVerifyMessageHash
CryptVerifyMessageSignature
CryptVerifyMessageSignatureWithKey
CryptVerifySignatureU
I_CertUpdateStore
I_CryptAllocTls
I_CryptCreateLruCache
I_CryptCreateLruEntry
I_CryptDetachTls
I_CryptFindLruEntry
I_CryptFindLruEntryData
I_CryptFlushLruCache
I_CryptFreeLruCache
I_CryptFreeTls
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
I_CryptGetDefaultCryptProv
I_CryptGetDefaultCryptProvForEncrypt
I_CryptGetOssGlobal
I_CryptGetTls
I_CryptInsertLruEntry
I_CryptInstallAsn1Module
I_CryptInstallOssGlobal
I_CryptReadTrustedPublisherDWORDValueFromRegistry
I_CryptReleaseLruEntry
I_CryptSetTls
I_CryptUninstallAsn1Module
I_CryptUninstallOssGlobal
PFXExportCertStore
PFXExportCertStoreEx
PFXImportCertStore
PFXIsPFXBlob
PFXVerifyPassword
RegCreateHKCUKeyExU
RegCreateKeyExU
RegDeleteValueU
RegEnumValueU
RegOpenHKCUKeyExU
RegOpenKeyExU
RegQueryInfoKeyU
RegQueryValueExU
RegSetValueExU

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 268KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 936KB - Virtual size: 934KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 320KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 544KB - Virtual size: 541KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3006159d3a5389b06f9f15bda4311386

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

kernel32

ntdll

ucrtbase

user32

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 395KB

.data Size: 12KB - Virtual size: 10KB

.rodata Size: 4KB - Virtual size: 1KB

.rdata Size: 64KB - Virtual size: 60KB

/4 Size: 4KB - Virtual size: 60B

.bss Size: - Virtual size: 12KB

.edata Size: 20KB - Virtual size: 19KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 268KB - Virtual size: 264KB

.reloc Size: 20KB - Virtual size: 17KB

/14 Size: 4KB - Virtual size: 1016B

/29 Size: 936KB - Virtual size: 934KB

/41 Size: 44KB - Virtual size: 43KB

/55 Size: 320KB - Virtual size: 316KB

/67 Size: 68KB - Virtual size: 64KB

/80 Size: 16KB - Virtual size: 15KB

/91 Size: 544KB - Virtual size: 541KB

/102 Size: 64KB - Virtual size: 63KB

.text
Size: 396KB - Virtual size: 395KB

.data
Size: 12KB - Virtual size: 10KB

.rodata
Size: 4KB - Virtual size: 1KB

.rdata
Size: 64KB - Virtual size: 60KB

/4
Size: 4KB - Virtual size: 60B

.bss
Size: - Virtual size: 12KB

.edata
Size: 20KB - Virtual size: 19KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 268KB - Virtual size: 264KB

.reloc
Size: 20KB - Virtual size: 17KB

/14
Size: 4KB - Virtual size: 1016B

/29
Size: 936KB - Virtual size: 934KB

/41
Size: 44KB - Virtual size: 43KB

/55
Size: 320KB - Virtual size: 316KB

/67
Size: 68KB - Virtual size: 64KB

/80
Size: 16KB - Virtual size: 15KB

/91
Size: 544KB - Virtual size: 541KB

/102
Size: 64KB - Virtual size: 63KB