05e05eb768554078b5d9052c0868b6eb9814fc9679f40d6c5773c0fd0d041339

Sharing

Copy URL Twitter E-mail

General

Target

05e05eb768554078b5d9052c0868b6eb9814fc9679f40d6c5773c0fd0d041339
Size

2.2MB
MD5

752764c12dc6632d9644fae061ea123a
SHA1

38bff4c63342c37124e7624df553d519786ce067
SHA256

05e05eb768554078b5d9052c0868b6eb9814fc9679f40d6c5773c0fd0d041339
SHA512

b2e6433fe432317e7c437137226bcffef6b50bcb54495280d29bb87907bb4a3d101c4cefe260f51f3650a409642685e2e2dd54ccb663d7f9fd443465e7128c72
SSDEEP

49152:KeFa9/srO747nIGptn8j1TNpp/nAA9O5d5hO:AhF4Vh8j1Ttn/9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05e05eb768554078b5d9052c0868b6eb9814fc9679f40d6c5773c0fd0d041339

Files

05e05eb768554078b5d9052c0868b6eb9814fc9679f40d6c5773c0fd0d041339
.dll windows:6 windows x86

d084b21d41c69bbae253f512761382be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

listen
ioctlsocket
gethostname
WSACleanup
shutdown
gethostbyname
getservbyname
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
htonl

wldap32

ord143
ord211
ord22
ord30
ord41
ord32
ord35
ord79
ord33
ord301
ord27
ord46
ord45
ord200
ord50
ord26

kernel32

GetCurrentProcess
WriteFile
SetFilePointer
CreateFileW
DuplicateHandle
CloseHandle
SystemTimeToFileTime
WideCharToMultiByte
GetFileType
DosDateTimeToFileTime
MulDiv
GetFileSize
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocalTime
TerminateProcess
GetLocaleInfoW
WaitForSingleObject
Sleep
LoadLibraryA
FreeLibrary
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
SleepEx
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoA
VerSetConditionMask
SizeofResource
GetModuleHandleA
GetCurrentThreadId
GetVersion
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FindClose
FlushConsoleInputBuffer
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
LocalFree
lstrcpynW
lstrcpyW
GlobalFree
FreeResource
LoadResource
FindResourceW
ReadFile
GetACP
MultiByteToWideChar
GetStdHandle
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTickCount
GetModuleHandleW
GetProcAddress
GetCurrentDirectoryW
GetModuleFileNameW
LoadLibraryW
ExitProcess
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
SetConsoleCtrlHandler
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LockResource
ReadConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
FlushFileBuffers
HeapReAlloc
GetFullPathNameW
SetStdHandle
SetEndOfFile
SetConsoleMode
ReadConsoleInputW
GetSystemDirectoryA

user32

DrawTextW
FillRect
GetCaretPos
GetSysColor
ClientToScreen
HideCaret
ShowCaret
GetWindowRgn
CharNextW
SetCursor
InflateRect
SetRect
GetPropW
SetPropW
TrackMouseEvent
CallWindowProcW
RegisterClassExW
GetClassInfoExW
RegisterClassW
LoadCursorW
GetSystemMetrics
CharPrevW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
MapWindowPoints
InvalidateRgn
CreateAcceleratorTableW
FindWindowW
OffsetRect
GetUserObjectInformationW
GetProcessWindowStation
KillTimer
GetMessageW
DispatchMessageW
TranslateMessage
ShowWindow
SendMessageW
GetKeyState
DestroyWindow
ReleaseDC
GetDC
GetClientRect
GetWindowLongW
LoadImageW
PostQuitMessage
EnableWindow
DefWindowProcW
wsprintfW
MessageBoxW
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
IsZoomed
MoveWindow
MessageBoxA
SetWindowLongW
GetCaretBlinkTime
SetCaretPos
CreateCaret
GetFocus
IntersectRect
GetWindow
SetFocus
GetUpdateRect
BeginPaint
EndPaint
GetParent
IsRectEmpty
IsIconic
UnionRect
GetWindowRect
UpdateLayeredWindow
InvalidateRect
CreateWindowExW
ScreenToClient
SetTimer
SetWindowPos
GetCursorPos
IsWindow
SetCapture
ReleaseCapture
PostMessageW
PtInRect

gdi32

GetStockObject
GetObjectW
Rectangle
RoundRect
GetObjectA
SetBkMode
CreateFontIndirectW
SetBkColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
CreatePen
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
SaveDC
RestoreDC
CreateCompatibleBitmap
BitBlt
GetTextMetricsW
CreateRoundRectRgn
CreateRectRgn
PtInRegion
GetDeviceCaps
SelectClipRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
CombineRgn
StretchBlt
SetStretchBltMode
CreateSolidBrush
CreatePenIndirect
MoveToEx
SetTextColor
SelectObject
LineTo

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
OleLockRunning
CLSIDFromString
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
VariantClear
VariantInit

gdiplus

GdipLoadImageFromStream
GdipImageSelectActiveFrame
GdipDrawImageRectI
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipFillRectangleI
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

comctl32

_TrackMouseEvent
ord17

Exports

Exports

CloseWnd
ControlBindNSISScript
ExitNsDui
FindControl
GetCheckBoxStatus
GetInstallDir
InitWnd
SelectInstallDir
SetCheckBoxStatus
SetInstallDir
SetInstallSpaceInfo
SetProgressValue
ShowMainWnd
ShowMessageDialog
nsDuiSendMessage

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 437KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d084b21d41c69bbae253f512761382be

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

imm32

comctl32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 357KB - Virtual size: 356KB

.data Size: 41KB - Virtual size: 55KB

.rsrc Size: 437KB - Virtual size: 437KB

.reloc Size: 66KB - Virtual size: 66KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 357KB - Virtual size: 356KB

.data
Size: 41KB - Virtual size: 55KB

.rsrc
Size: 437KB - Virtual size: 437KB

.reloc
Size: 66KB - Virtual size: 66KB