ddce95e153ade01486fb806ad46196cd1d7f23989c95c5ff322875d395880c5c

Sharing

Copy URL

Twitter E-mail

General

Target

ddce95e153ade01486fb806ad46196cd1d7f23989c95c5ff322875d395880c5c
Size

2.2MB
MD5

7d61527489b49966621e8e9bfa8fa8e5
SHA1

dfb9ee6db7f5fb37688f59afd602c6095abb8538
SHA256

ddce95e153ade01486fb806ad46196cd1d7f23989c95c5ff322875d395880c5c
SHA512

bef68e27ff345301f7836160bf5c7836d03408aa3df270e95a0d1d88b1d4e587d66ef9ec294fb5abb273cd13968359e48f18bba48bb57377beb0f1177b713be8
SSDEEP

49152:JJLaFl3U6zJQ2b+frT+zgHhqtEyKTxJyuVvh:JJQA4UM2ysJyuVvh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddce95e153ade01486fb806ad46196cd1d7f23989c95c5ff322875d395880c5c

Files

ddce95e153ade01486fb806ad46196cd1d7f23989c95c5ff322875d395880c5c
.dll regsvr32 windows:6 windows x64

3bbb061e65ec70267a51fdfb331920da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetSystemDefaultLangID
GetPrivateProfileStringA
GetPrivateProfileIntA
GetExitCodeThread
GetCurrentProcessId
GetCurrentProcess
CreateFileA
GetTickCount
CreateThread
Sleep
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
ReadConsoleW
SetFilePointerEx
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
CloseHandle
OutputDebugStringA
SetThreadLocale
GetThreadLocale
GetModuleHandleW
EncodePointer
IsDBCSLeadByte
WideCharToMultiByte
MultiByteToWideChar
FindResourceA
lstrlenA
lstrcmpiA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LoadResource
LoadLibraryExA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
SetUnhandledExceptionFilter
RaiseException
DecodePointer
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
MoveFileExW
DeleteFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapSize
GetStdHandle
GetACP
GetTempPathW
GetModuleHandleExW
HeapReAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
VirtualQuery
GetSystemInfo
RtlUnwindEx
RtlPcToFileHeader
LoadLibraryW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
HeapAlloc
HeapFree
GetProcessHeap
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
ExitProcess
ReadFile
WriteFile
SetFilePointer
LocalAlloc
CreateFileW
UnmapViewOfFile
CreateFileMappingA
LocalFree
GetFileSize
MapViewOfFile
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait

user32

BeginPaint
UnregisterClassA
DefWindowProcA
CallWindowProcA
RegisterClassExA
GetClassInfoExA
CreateWindowExA
IsWindow
ReleaseDC
DestroyWindow
ShowWindow
SetWindowPos
CharNextA
SetFocus
GetFocus
GetKeyState
EndPaint
IsChild
GetWindowLongPtrA
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
DrawTextA
CharNextW
LoadCursorA
GetParent
SetWindowLongPtrA
MessageBoxA
PtInRect
EqualRect
OffsetRect
UnionRect
IntersectRect
GetClientRect
InvalidateRect
SetWindowRgn
GetSystemMetrics
GetDC

gdi32

SetTextColor
SetBkMode
SetBkColor
SelectObject
DeleteObject
CreateFontA
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
LPtoDP
TextOutA
SetTextAlign
SetMapMode
SelectClipRgn
SaveDC
RestoreDC
Rectangle
GetDeviceCaps
GetClipRgn
DeleteMetaFile
DeleteDC
CreateRectRgnIndirect
CreateRectRgn
CreateMetaFileA
CreateDCA
CloseMetaFile
RoundRect
CreateSolidBrush
SetStretchBltMode
Ellipse
MoveToEx
SetDIBitsToDevice
CreatePen
LineTo
GetTextExtentPointA
GetStockObject
StretchDIBits
CreateHatchBrush
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
PatBlt

advapi32

RegQueryInfoKeyA
RegSetValueExA
RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey

shell32

SHCreateDirectoryExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateDataAdviseHolder
ReadClassStm
WriteClassStm
OleSaveToStream
CreateOleAdviseHolder
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
StringFromGUID2
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysStringLen
SysStringByteLen
VariantClear
VariantChangeType
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreatePropertyFrame
SysAllocStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString

dbghelp

MiniDumpWriteDump

winmm

PlaySoundA

msimg32

TransparentBlt
AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EC_Iris_CheckDevice
EC_Iris_EnrollFeature_Async
EC_Iris_EnrollTmpl_Async
EC_Iris_ExtractFeature
EC_Iris_GetFeature
EC_Iris_IrisImageCapure_Async
EC_Iris_SetEventofPick
EC_Iris_SetEventofPreview
TcAddIrisFea
TcBeepLight
TcCancelCapture
TcCheckDevice
TcCloseDevice
TcClsIrisFea
TcCreateHDL
TcDelIrisFeat
TcDeleteHDL
TcDetectIris_Monitor
TcDoFeature
TcDoIdentify
TcDoIdentify_Memory
TcDoIdentify_Monitor
TcDoTemplet
TcDoVerify
TcExtnEntry
TcGetConnectedDevice
TcGetImage
TcGetImgDat
TcIrisImageCap
TcOpenDevice
TcReParentWnd
TcRedraw
TcSetActionHint
TcSetCallFunc
TcShowImage
TcUpDateIrisFea
TcZoomRate

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 441KB - Virtual size: 441KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3bbb061e65ec70267a51fdfb331920da

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dbghelp

winmm

msimg32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 436KB - Virtual size: 436KB

.data Size: 31KB - Virtual size: 39KB

.pdata Size: 65KB - Virtual size: 65KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 441KB - Virtual size: 441KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 436KB - Virtual size: 436KB

.data
Size: 31KB - Virtual size: 39KB

.pdata
Size: 65KB - Virtual size: 65KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 441KB - Virtual size: 441KB

.reloc
Size: 8KB - Virtual size: 7KB