d6239a05a40e34f6460523cf41d7aed127c6a304dce83d1dbb02117a3d539401

Sharing

Copy URL Twitter E-mail

General

Target

d6239a05a40e34f6460523cf41d7aed127c6a304dce83d1dbb02117a3d539401
Size

1.2MB
MD5

c13aeaf39e749e5fb618c34dc30c8591
SHA1

f9c8a03ec2e12854b6fd8960617e7fa045433cf3
SHA256

d6239a05a40e34f6460523cf41d7aed127c6a304dce83d1dbb02117a3d539401
SHA512

3cda68165fdda28cf211d8a36a34d115c813c0ef747b5f18eb73c3437c11eae7a33f0885a1e71c62882c2b18c30bd651cac772db35f817d11d5eec97c61384db
SSDEEP

24576:kHvu442EUEfXZWpglIjVSnW7THYZpN9e7:kHvV4nUEfZWpglIjVNYZpC7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6239a05a40e34f6460523cf41d7aed127c6a304dce83d1dbb02117a3d539401

Files

d6239a05a40e34f6460523cf41d7aed127c6a304dce83d1dbb02117a3d539401
.dll windows:5 windows x64

4491a8bbe8e9b1b27f68b07a8b45bf47

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertFindExtension
CertGetNameStringA
CertOpenStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertCreateCertificateContext
CertFreeCertificateContext
CertCloseStore
PFXImportCertStore
CryptAcquireCertificatePrivateKey
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

winmm

PlaySoundA
timeGetTime

shlwapi

PathFindFileNameA
StrStrIA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

kernel32

GetFileAttributesA
GetFileSizeEx
GetFileTime
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
ExitProcess
ExitThread
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
FlsSetValue
HeapReAlloc
HeapQueryInformation
HeapSize
HeapSetInformation
HeapCreate
HeapDestroy
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
SetHandleCount
GetStartupInfoA
InitializeCriticalSectionAndSpinCount
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
SetStdHandle
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
FileTimeToSystemTime
GetModuleHandleW
GetOEMCP
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
TlsGetValue
GlobalFlags
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GetModuleFileNameW
SetErrorMode
SuspendThread
SetThreadPriority
FormatMessageA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GetStdHandle
GetFileType
GetVersionExW
LoadLibraryW
GlobalMemoryStatus
QueryPerformanceCounter
lstrlenW
GetCPInfo
lstrlenA
lstrcmpiA
FreeResource
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CreateEventA
ResumeThread
GlobalAlloc
SetEvent
ResetEvent
GetUserDefaultUILanguage
WritePrivateProfileStringA
GetPrivateProfileStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetExitCodeThread
GetModuleHandleA
CreateThread
GetSystemDirectoryA
DeviceIoControl
CreateFileA
HeapFree
DeleteFileA
SystemTimeToFileTime
FileTimeToLocalFileTime
GetProcessHeap
HeapAlloc
DisableThreadLibraryCalls
GetCommandLineA
GetCurrentThreadId
GetLocalTime
MultiByteToWideChar
LocalReAlloc
LocalAlloc
LoadLibraryExA
GetModuleFileNameA
WaitForSingleObject
FindResourceA
LoadResource
LockResource
SizeofResource
LoadLibraryA
GetProcAddress
WideCharToMultiByte
FreeLibrary
FlushViewOfFile
GetCurrentProcessId
ReleaseMutex
GetVersion
OpenMutexA
CloseHandle
Sleep
CreateMutexA
GetVersionExA
CreateFileMappingA
GetLastError
MapViewOfFile
UnmapViewOfFile
SetLastError
LocalFree
RtlCaptureContext

user32

DeferWindowPos
PtInRect
GetDlgCtrlID
GetMenu
GetWindowPlacement
GetWindow
CreateDialogIndirectParamA
IsWindowEnabled
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
GetCursorPos
SetCursorPos
mouse_event
DestroyCursor
SetCursor
WindowFromPoint
GetNextDlgTabItem
ClientToScreen
GetIconInfo
CreateIconIndirect
DrawStateA
IsMenu
GetMenuItemInfoA
SystemParametersInfoA
DrawIconEx
DestroyIcon
GrayStringA
DrawTextExA
TabbedTextOutA
GetSysColorBrush
GetSubMenu
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuA
CreatePopupMenu
CreateMenu
DrawEdge
LoadBitmapA
RedrawWindow
MoveWindow
LoadCursorA
GetClassInfoA
RegisterClassA
CreateWindowExA
SetWindowLongA
SetRect
GetSysColor
LoadImageA
GetSystemMetrics
IsRectEmpty
EmptyClipboard
SetClipboardData
LoadIconA
SetParent
GetFocus
GetWindowThreadProcessId
AttachThreadInput
IsWindowVisible
SetActiveWindow
RegisterWindowMessageA
CallWindowProcA
GetWindowLongA
GetParent
ReleaseCapture
GetDC
ValidateRect
FrameRect
InflateRect
ReleaseDC
SetCapture
BeginPaint
FillRect
GetWindowTextA
DrawTextA
EndPaint
CreateDialogParamA
DestroyWindow
SetWindowsHookExA
UnhookWindowsHookEx
GetAsyncKeyState
CallNextHookEx
IsIconic
ShowWindow
GetSystemMenu
CheckMenuItem
ModifyMenuA
GetKeyState
keybd_event
ScreenToClient
InvalidateRect
GetClientRect
GetWindowLongPtrA
SetWindowLongPtrA
EndDialog
DialogBoxParamA
IsWindow
GetDlgItem
SetWindowTextA
GetDesktopWindow
GetWindowRect
CopyRect
OffsetRect
SetWindowPos
DefFrameProcA
DefMDIChildProcA
DefDlgProcA
DefWindowProcA
GetForegroundWindow
MessageBoxA
SendMessageA
FindWindowA
PostMessageA
SetForegroundWindow
GetActiveWindow
KillTimer
SetTimer
EnableWindow
SetRectEmpty
DestroyMenu
CharUpperA
PostQuitMessage
GetWindowDC
GetMessageA
TranslateMessage
GetMenuStringA
IsDialogMessageA
OpenClipboard
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetLastActivePopup
DispatchMessageA
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
TrackPopupMenu
SetMenu
UpdateWindow
GetClassInfoExA
AdjustWindowRectEx
CloseClipboard
EqualRect
DrawFocusRect

gdi32

GetTextExtentPoint32A
CreateDIBSection
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextExtentPoint32W
SetBkColor
CreateBitmap
GetObjectW
CreateDCW
GetClipBox
SaveDC
RestoreDC
SetPixel
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCharWidthA
CreateFontA
StretchDIBits
GetBkColor
GetPixel
PatBlt
Ellipse
GetBkMode
CreatePen
CreateFontIndirectA
GetDeviceCaps
CreateSolidBrush
SetStretchBltMode
StretchBlt
CreateDCA
CreateCompatibleBitmap
DeleteDC
BitBlt
CreateCompatibleDC
GetBitmapBits
GetObjectA
DeleteObject
SelectObject
SetBkMode
SetTextColor
GetStockObject

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

ReportEventW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptSetKeyParam
CryptImportKey
CryptSetProvParam
CryptAcquireContextA
CryptExportKey
CryptGetUserKey
CryptReleaseContext
CryptDestroyKey
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AddAccessAllowedAce
InitializeAcl
GetLengthSid
LookupAccountNameA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegisterEventSourceW
DeregisterEventSource
RegOpenKeyExA
GetUserNameA

shell32

SHGetFolderPathA
ShellExecuteExA

comctl32

_TrackMouseEvent
InitCommonControlsEx

ole32

CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
OleLoadPicture

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipDrawImageRectI
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdipLoadImageFromStream
GdipDeleteGraphics

Exports

Exports

CSPAddCertToIE
CSPCertHasLogon
CSPDelCertFromIE
CSPDeleteContainer
CSPLoadCertToIE
CSPRefreshIECert
CSPRegistCert
CSPUnAllIECert
ClearShare
HC_19eGenAndExportPubKey
HC_CSPImportP12Cert
HC_CSPImportP12CertEx
HC_CSPImportP12CertSpec
HC_ChangeSOPin
HC_ChangeSOPinEx
HC_ChangeUserPin
HC_ChangeUserPinEx
HC_ChangeUserPinSec
HC_ChangeUserPinSecEx
HC_CreateContainer
HC_CreateContainerEx
HC_CreateFile
HC_CreateFileEx
HC_DESCbc
HC_DESCbcEx
HC_DESEcb
HC_DESEcbEx
HC_DelCertEx
HC_DelContainer
HC_DelContainerEx
HC_DeleteCert
HC_EraseHW
HC_EraseHWEx
HC_ExportRSAPubKey
HC_ExportRSAPubKeyEx
HC_FindContainerEx
HC_FormatHW
HC_FormatHWEx
HC_FormatHWSecEx
HC_GenRSA
HC_GenRSAEx
HC_GenRandom
HC_GenSM2ExportPubKey
HC_GetContainerName
HC_GetContainerNameEx
HC_GetContainerNum
HC_GetContainerNumEx
HC_GetContainerParam
HC_GetContainerParamEx
HC_GetCurSORetryNumEx
HC_GetCurUserRetryNumEx
HC_GetDevType
HC_GetDevTypeEx
HC_GetFreeSize
HC_GetHWApp
HC_GetHWAppEx
HC_GetHWPubRSAEx
HC_GetPressKeyType
HC_GetSOPinRetryNum
HC_GetSerial
HC_GetSerialB
HC_GetSerialEx
HC_GetTotalSize
HC_GetUserPinRetryNum
HC_HW3DES112Ecb
HC_HWDESEcb
HC_HWSymEcbEx
HC_ImportEncRSAEx
HC_ImportRSA
HC_ImportRSAEx
HC_InitUserDFKeyFile
HC_ListContainers
HC_ListContainersEx
HC_MD5
HC_MD5Ex
HC_RSADecrypt
HC_RSADecryptEx
HC_RSAEncrypt
HC_RSAEncryptEx
HC_RSASign
HC_RSASignEx
HC_RSAVerify
HC_RSAVerifyEx
HC_ReWriteUserPin
HC_ReWriteUserPinEx
HC_ReadCSPCtrl
HC_ReadCSPCtrlEx
HC_ReadCert
HC_ReadCertEx
HC_ReadFile
HC_ReadFileEx
HC_ReadLabel
HC_ReadLabelEx
HC_SCB2Cbc
HC_SCB2Ecb
HC_SHA1
HC_SHA1Ex
HC_SM2CFCASign
HC_SM2Decrypt
HC_SSF33Ecb
HC_SessionSymEcbEx
HC_SpecSymEcb
HC_SpecSymEcbEx
HC_SpecWriteKey
HC_SpecWriteKeyEx
HC_SupportHighBuf
HC_UDiskSessionSymEcbEx
HC_USBSessionSymEcbEx
HC_USBSpecSymEcbEx
HC_VerifySOPin
HC_VerifySOPinEx
HC_VerifyUserPin
HC_VerifyUserPinEx
HC_VerifyUserPinSec
HC_VerifyUserPinSecEx
HC_WriteCert
HC_WriteCertEx
HC_WriteFile
HC_WriteFileEx
HC_WriteKey
HC_WriteKeyEx
HC_WriteLabel
HC_WriteLabelEx
HC_WriteLabelSec
HC_WriteRSAKeyEx
HC_WriteRSAPubKeyEx
HRGetAdmPinTryNum
HRGetAdmTitle
HRGetBankApp
HRGetCFCA
HRGetCSPProvider
HRGetCSPSafeSym
HRGetCSPVer
HRGetCachedCSPName
HRGetCachedPINName
HRGetCertExpiredDays
HRGetCertExpiredLink
HRGetCheckTJCA
HRGetConType
HRGetContainerNum
HRGetDefaultAdmPin
HRGetDefaultHWLabel
HRGetDefaultUserPin
HRGetExeName
HRGetFirmName
HRGetHTID
HRGetHWName
HRGetIEClosedClearCached
HRGetJitDelContainer
HRGetKoalKeyNum
HRGetLedButtonOverTime
HRGetMaxCertLen
HRGetMsnTitle
HRGetMsnType
HRGetPWSGrade
HRGetPinLen
HRGetPinMode
HRGetPinModeEx
HRGetPressButtonOverTime
HRGetRegCertInfoLen
HRGetRemoveAppMode
HRGetSCB2AlgID
HRGetSCB2OID
HRGetSSF33AlgID
HRGetSSF33OID
HRGetSecDFCreate
HRGetSoftKeyBoardMode
HRGetSpecUserKeyNum
HRGetSrvTitle
HRGetTwoRSAType
HRGetUnblockKey
HRGetUserPinTryNum
HRGetUserTitle
HRGetVerifyPINTime
HRGetZWWXKeyPinMode
HRIsInputNumber
HRMustNullContainer
HRSetSoftKeyBoardMode
HRSetVerifyPINTime
HTClearAllCachedPin
HTClearCachedCSP
HTClearCachedPin
HTCreateCachedCSP
HTCreateCachedPin
HTGetUIPin
HTGetUIReaderName
HTReadCachedCSP
HTReadCachedPin
HTRefreshCachedPin
HTShowUIInfo
HTWriteCachedCSP
HTWriteCachedPin
HWActiveMF
HWCanDelFile
HWChangePin
HWCreateDF
HWCreateEF
HWCreateMF
HWDESCrypt
HWDelDF
HWDelEF
HWDelMF
HWExportEncSCB2
HWExportEncSSF33
HWExportSCB2EncRSA
HWGenHuaXiaSoPin
HWGenRSA
HWGenRandom
HWGenSessionSCB2
HWGenSessionSSF33
HWGenTempRSA
HWGetBufLen
HWGetCOSVer
HWGetDevType
HWGetFreeSize
HWGetHWCategory
HWGetHWType
HWGetPinCacheFlag
HWGetPressKeyType
HWGetRSAMode
HWGetResponse
HWGetSOPinRetryNum
HWGetSerial
HWGetSessionSCB2
HWGetSessionSSF33
HWGetShowPin
HWGetSupportEncMacCMD
HWGetSymSupport
HWGetTimepiece
HWGetTotalSize
HWGetUserPinRetryNum
HWGetVerifyPinMode
HWImportEncSessionSCB2
HWImportEncSessionSSF33
HWIsPsamKey
HWPriKeyDoRaw
HWPubKeyDoRaw
HWReadCID
HWReadEF
HWReadPCODE
HWReadPubKey
HWReadReservedSection
HWSCB2Crypt
HWSSF33Dec
HWSSF33Enc
HWSSF33Sym
HWSelDF
HWSelEF
HWSelMF
HWSetPinCacheFlag
HWSetShowPin
HWSetUserPinRetryNum
HWUDiskSCB2Crypt
HWUnlockHuaxiaUsrPinWithSoPin
HWUsbDESCrypt
HWUsbGetSymSupport
HWUsbSCB2Crypt
HWUsbSSF33Sym
HWUsbVerifyPin
HWVerifyPin
HWWriteCID
HWWriteEF
HWWriteKey
HWWriteKeyEx
HWWritePCODE
HWWritePriKey
HWWritePubKey
HWWriteRSA
HWWriteReservedSection
HWWriteSessionSCB2Key
HWWriteSessionSSF33Key
HexToStr
LngGetDefaultItem
LngLoadString
LngSetDefaultItem
PCODE_Compare
PCODE_GetfromConfig
PCODE_GetfromHW
PCODE_IsCheck
PinCode
PressKeyTransmit
RSAPad
RelAcquireContext
RelCreateHash
RelDecrypt
RelDeriveKey
RelDestroyHash
RelDestroyKey
RelDuplicateHash
RelDuplicateKey
RelEncrypt
RelExportKey
RelGenKey
RelGenRandom
RelGetHashParam
RelGetKeyParam
RelGetProvParam
RelGetUserKey
RelHashData
RelHashSessionKey
RelImportKey
RelReleaseContext
RelSetHashParam
RelSetKeyParam
RelSetProvParam
RelSignHash
RelVerifySignature
e19fastsign

Sections

.text
Size: 750KB - Virtual size: 749KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4491a8bbe8e9b1b27f68b07a8b45bf47

Headers

File Characteristics

Imports

crypt32

rpcrt4

setupapi

winmm

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 750KB - Virtual size: 749KB

.rdata Size: 259KB - Virtual size: 259KB

.data Size: 102KB - Virtual size: 161KB

.pdata Size: 42KB - Virtual size: 42KB

.rsrc Size: 72KB - Virtual size: 71KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 750KB - Virtual size: 749KB

.rdata
Size: 259KB - Virtual size: 259KB

.data
Size: 102KB - Virtual size: 161KB

.pdata
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 31KB - Virtual size: 31KB