e5c410eb19053b261be3e6f87e3af65b41fa3bb5ea0d8eb86f63a4fa2238446a

Sharing

Copy URL

Twitter E-mail

General

Target

e5c410eb19053b261be3e6f87e3af65b41fa3bb5ea0d8eb86f63a4fa2238446a
Size

306KB
MD5

24db3b505b25866175f481cb0e5990bb
SHA1

d62a70e2eccdcbca801cb54530093b1f172bb051
SHA256

e5c410eb19053b261be3e6f87e3af65b41fa3bb5ea0d8eb86f63a4fa2238446a
SHA512

a6aca4f3464c527c97ca4086ba73a1ac987b52706ba981659c5a0e15055955cfef9388d410018f10a8e6f832399ce6046cb3ba07df9ae8285b5c69a4fb942e30
SSDEEP

6144:SSOi5GVuJSOnprcUcx5ONk2A2CRvjtL/0FuTANfr2tJetkfgKwAOAJPw:57pwUcxfT5gDaw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5c410eb19053b261be3e6f87e3af65b41fa3bb5ea0d8eb86f63a4fa2238446a

Files

e5c410eb19053b261be3e6f87e3af65b41fa3bb5ea0d8eb86f63a4fa2238446a
.dll windows:6 windows x64

962376fed1627fb75531480092867965

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

dxgi

CreateDXGIFactory1

d3d10

D3D10CreateDeviceAndSwapChain

d3d10_1

D3D10CreateDeviceAndSwapChain1

ws_log

ord341
ord2

kernel32

GetCurrentThreadId
CloseHandle
CreateThread
InitializeCriticalSection
LeaveCriticalSection
GetLastError
EnterCriticalSection
OpenFileMappingW
DeleteCriticalSection
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateProcessW
GetCurrentProcess
SetEvent
GetModuleHandleW
GetTickCount
GetExitCodeProcess
OpenMutexW
ResetEvent
CreateEventW
OpenEventW
ResumeThread
Sleep
IsWow64Process
GetCurrentProcessId
GetVersionExW
FindFirstFileW
FindClose
LocalFree
InitializeCriticalSectionEx
DecodePointer
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
LoadLibraryW
GetProcAddress
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
OpenProcess

user32

DispatchMessageW
DefWindowProcW
RegisterClassW
PostThreadMessageW
CreateWindowExW
ShowWindow
TranslateMessage
FindWindowW
GetMessageW
RegisterClassExW
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassW
wsprintfW
DestroyWindow

advapi32

RegSetValueExW
AllocateAndInitializeSid
RegDeleteValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertStringSidToSidW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
FreeSid
RegOpenKeyExW
CheckTokenMembership
RegCloseKey
SetEntriesInAclW

ole32

CoCreateGuid
StringFromGUID2
CoTaskMemFree
StringFromCLSID
CoGetMalloc
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
VariantClear

msvcp120

_Mtx_destroy
_Mtx_init
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_unlock
_Mtx_lock
?_Orphan_all@_Container_base12@std@@QEAAXXZ
??1_Container_base12@std@@QEAA@XZ
??0_Container_base12@std@@QEAA@XZ
?_Throw_C_error@std@@YAXH@Z

msvcr120

__dllonexit
__C_specific_handler
_onexit
__CppXcptFilter
__CxxFrameHandler3
_amsg_exit
_calloc_crt
_unlock
_lock
wcscmp
??_V@YAXPEAX@Z
fabs
tolower
wcslen
_malloc_crt
_initterm
_initterm_e
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
_CxxThrowException
__crtCapturePreviousContext
memcmp
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
wcscpy_s
memcpy
_purecall
wcscpy
_snwprintf
_beginthreadex
swprintf_s
memmove
strncmp
free
pow
malloc
strlen

Exports

Exports

DllGetClassObject

Sections

.text
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

962376fed1627fb75531480092867965

Headers

DLL Characteristics

File Characteristics

Imports

dxgi

d3d10

d3d10_1

ws_log

kernel32

user32

advapi32

ole32

oleaut32

msvcp120

msvcr120

Exports

Exports

Sections

.text Size: 207KB - Virtual size: 206KB

.rdata Size: 78KB - Virtual size: 77KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 980B

.text
Size: 207KB - Virtual size: 206KB

.rdata
Size: 78KB - Virtual size: 77KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 980B