37ec0b51f0161487b58df0347bb5aeaa8a0d5

Sharing

Copy URL Twitter E-mail

General

Target

37ec0b51f0161487b58df0347bb5aeaa8a0d5
Size

832KB
MD5

4e33510a6614c55bf4f6a9cee97e9142
SHA1

c5437ec0b51f0161487b58df0347bb5aeaa8a0d5
SHA256

c8de011cf1e6f60632041e506df04f231d4cfd463b8836ffb2fd28ee2c63e9fa
SHA512

8d82ce8dcabbeaa3c929c773ff957ebd4560c26c75f5391affa8df77e024914f0a41ec1885d48e3b07fb335a9960d7b2404b5d676a2cd3865e71491789fcdfb3
SSDEEP

24576:PXI5P50RmyOWwZENH0uyE3nMXTUtZ+6iHjo:m4EY0cav

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37ec0b51f0161487b58df0347bb5aeaa8a0d5

Files

37ec0b51f0161487b58df0347bb5aeaa8a0d5
.dll regsvr32 windows:4 windows x86

43bb9dbeb0875b1b892f94ccfdac3bc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
CloseHandle
DeviceIoControl
CreateFileA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
WaitForSingleObject
DeleteFileA
SetErrorMode
GetFileType
GetDriveTypeA
GetFullPathNameA
GlobalMemoryStatus
GetProcessHeap
GetTickCount
SetFilePointer
GetFileSize
SetFileTime
SetEndOfFile
CreateDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
Sleep
VirtualLock
VirtualUnlock
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetProcessWorkingSetSize
GetThreadTimes
GetProcessTimes
ReadFile
IsBadReadPtr
IsBadWritePtr
GetStartupInfoA
QueryPerformanceCounter
GetModuleHandleA
GetLastError
FormatMessageA
FreeLibrary
LoadLibraryA
GetProcAddress
WriteFile
FlushFileBuffers

user32

GetCursorPos
GetCaretPos
GetProcessWindowStation
GetOpenClipboardWindow
GetInputState
GetFocus
GetDesktopWindow
GetClipboardViewer
GetClipboardOwner
GetCapture
GetActiveWindow
MessageBoxA
GetMessageTime
GetMessagePos

advapi32

CryptSetKeyParam
RegCloseKey
CryptAcquireContextA
RegOpenKeyExA
LookupAccountSidA
RegQueryValueExA
OpenProcessToken
OpenThreadToken
GetTokenInformation
CryptGetProvParam
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl

msvcrt

_strnicmp
_stricmp
strncpy
memmove
_adjust_fdiv
_initterm
time
calloc
strncat
vsprintf
_beginthreadex
realloc
malloc
free
sprintf
toupper
_pctype
__mb_cur_max
_isctype
_endthreadex
atoi
strncmp
sscanf
strchr
gmtime
strstr
mktime
tolower

Exports

Exports

DllRegisterServer
_bapiclGetPKCS10publicKey@12
cryptAddCertExtension
cryptAddPrivateKey
cryptAddPublicKey
cryptAddRandom
cryptAsyncCancel
cryptAsyncQuery
cryptCAAddItem
cryptCACertManagement
cryptCADeleteItem
cryptCAGetItem
cryptCheckCert
cryptCheckSignature
cryptCheckSignatureEx
cryptCreateCert
cryptCreateContext
cryptCreateEnvelope
cryptCreateSession
cryptCreateSignature
cryptCreateSignatureEx
cryptDecrypt
cryptDeleteAttribute
cryptDeleteCertExtension
cryptDeleteKey
cryptDestroyCert
cryptDestroyContext
cryptDestroyEnvelope
cryptDestroyObject
cryptDestroySession
cryptDeviceClose
cryptDeviceCreateContext
cryptDeviceOpen
cryptDeviceQueryCapability
cryptEncrypt
cryptEnd
cryptExportCert
cryptExportKey
cryptExportKeyEx
cryptFlushData
cryptGenerateKey
cryptGenerateKeyAsync
cryptGetAttribute
cryptGetAttributeString
cryptGetCertExtension
cryptGetPrivateKey
cryptGetPublicKey
cryptImportCert
cryptImportKey
cryptImportKeyEx
cryptInit
cryptKeysetClose
cryptKeysetOpen
cryptLogin
cryptLogout
cryptPopData
cryptPushData
cryptQueryCapability
cryptQueryObject
cryptSetAttribute
cryptSetAttributeString
cryptSignCert

Sections

.text
Size: 600KB - Virtual size: 598KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43bb9dbeb0875b1b892f94ccfdac3bc3

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Exports

Exports

Sections

.text Size: 600KB - Virtual size: 598KB

.rdata Size: 148KB - Virtual size: 144KB

.data Size: 52KB - Virtual size: 51KB

.rsrc Size: 4KB - Virtual size: 792B

.reloc Size: 24KB - Virtual size: 20KB

.text
Size: 600KB - Virtual size: 598KB

.rdata
Size: 148KB - Virtual size: 144KB

.data
Size: 52KB - Virtual size: 51KB

.rsrc
Size: 4KB - Virtual size: 792B

.reloc
Size: 24KB - Virtual size: 20KB