27ebe7e7651306f24c5f6700cd1a4709cbccf583494cd9a5be57033910e21ac0

Sharing

Copy URL Twitter E-mail

General

Target

27ebe7e7651306f24c5f6700cd1a4709cbccf583494cd9a5be57033910e21ac0
Size

7.0MB
MD5

b019b148541b34912ce254a37c8ed278
SHA1

fc369a4c6803560b291db1402e15a3e5110fbf85
SHA256

27ebe7e7651306f24c5f6700cd1a4709cbccf583494cd9a5be57033910e21ac0
SHA512

c0c57366242fc1f710c7d1db0315d3a42e8c73fa23fb72ce52cbeb3c2e1ad314521faf45d58721c8765e414e31152467997e3266f4046db1dc18ffa4df926621
SSDEEP

98304:fRF1s/WjaxFTOyHTaxMXdlwT0yUVNlClAReedNEDwVczRMlXKW7NHo/OKG:p2rxOyHTa+XfO8HlJRe2iDwV1d9oxG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27ebe7e7651306f24c5f6700cd1a4709cbccf583494cd9a5be57033910e21ac0

Files

27ebe7e7651306f24c5f6700cd1a4709cbccf583494cd9a5be57033910e21ac0
.dll windows:5 windows x86

cc2a1db16508329feefa7227fc4f7529

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
CreateFileW
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcess
GetPrivateProfileStringA
GetModuleHandleA
CreateFileA
SetFileTime
WriteFile
GetFileAttributesA
GetFileAttributesW
ReadFile
lstrcatA
FindFirstFileA
lstrcmpiA
RemoveDirectoryA
SetFileAttributesA
FindClose
FindNextFileA
DeleteFileA
GetNativeSystemInfo
InterlockedDecrement
LocalAlloc
InterlockedIncrement
LoadLibraryW
SetFilePointer
FreeResource
MapViewOfFile
FindResourceExW
FindResourceW
LoadResource
CreateProcessW
VerSetConditionMask
MoveFileExW
GetModuleHandleExW
CreateDirectoryW
WaitForSingleObject
ExpandEnvironmentStringsA
WideCharToMultiByte
SizeofResource
GetVersionExW
GetModuleFileNameW
GetSystemDirectoryA
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
VerifyVersionInfoW
CreateDirectoryA
CreateFileMappingA
LockResource
GetModuleFileNameA
WinExec
GetCurrentProcessId
GetSystemTime
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetEndOfFile
GetDriveTypeW
SetEnvironmentVariableA
GetSystemDirectoryW
GetModuleHandleW
VirtualProtect
LoadLibraryA
VirtualAlloc
GetProcAddress
IsBadReadPtr
GetProcessHeap
VirtualFree
HeapFree
HeapAlloc
FreeLibrary
lstrcpyA
LocalFree
OutputDebugStringA
GetLastError
FormatMessageA
GetTickCount
OutputDebugStringW
CreateMutexW
lstrlenA
CompareStringW
GetTimeZoneInformation
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FindFirstFileExA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateThread
ExitThread
SleepEx
InitializeCriticalSection
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
RtlUnwind
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
ExitProcess
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError

user32

MessageBoxA
wsprintfW

advapi32

ControlService
StartServiceW
CreateServiceA
OpenSCManagerW
DeleteService
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegCreateKeyExW
SetNamedSecurityInfoA
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
RegOpenKeyExA
LookupPrivilegeValueW
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
RegQueryValueExW

ole32

CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

PathAddBackslashA
PathRemoveFileSpecA
PathRemoveExtensionA
PathAddExtensionA
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsA
PathFileExistsW
PathAppendA
PathAppendW
PathFindFileNameA

ws2_32

WSAGetLastError
recv
send
setsockopt
getsockname
ntohs
bind
htons
WSACleanup
getpeername
closesocket
socket
connect
WSASetLastError
freeaddrinfo
getaddrinfo
__WSAFDIsSet
select
ioctlsocket
gethostname
getsockopt
WSAStartup

Exports

Exports

dll_run

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 286KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc2a1db16508329feefa7227fc4f7529

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

ws2_32

Exports

Exports

Sections

.text Size: 294KB - Virtual size: 293KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 286KB - Virtual size: 294KB

.rsrc Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 294KB - Virtual size: 293KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 286KB - Virtual size: 294KB

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 31KB - Virtual size: 30KB