fee20fcc6cc55338e5d56e457a3fcf15598b3dd9112d97a5820d4daf54419fe6

Sharing

Copy URL Twitter E-mail

General

Target

fee20fcc6cc55338e5d56e457a3fcf15598b3dd9112d97a5820d4daf54419fe6
Size

232KB
MD5

c83d3ab6d3cd58667f7c5faf3adafb66
SHA1

d78fd03c708c49c15615fcaafb6e1ed646641d6f
SHA256

fee20fcc6cc55338e5d56e457a3fcf15598b3dd9112d97a5820d4daf54419fe6
SHA512

6d2f4e0f4f910ba2bd624a7c6f59e887dee644c0387b4f7d999c3a8086b78feae487ffecb54a7b1a16b6945fc1b3517802e36bcb8c1df1fad74ff28b86e8b795
SSDEEP

3072:6ZCdefR1nHNfORTQng+U/rf8BDOYB9XzOrZCvY56lziLHO3bl+YH8G8nE:6FfVORTQnYjmDzPXcuHzEuQTE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fee20fcc6cc55338e5d56e457a3fcf15598b3dd9112d97a5820d4daf54419fe6

Files

fee20fcc6cc55338e5d56e457a3fcf15598b3dd9112d97a5820d4daf54419fe6
.dll windows:6 windows x64

ac193a207932337068c68e7b70e237ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

userenv

CreateEnvironmentBlock
GetUserProfileDirectoryW

winspool.drv

GetJobW
SetJobW
ClosePrinter
OpenPrinterW

advapi32

DuplicateTokenEx
LookupAccountSidW
RevertToSelf
GetUserNameW
ImpersonateLoggedOnUser
GetTokenInformation
OpenProcessToken
LogonUserW
LookupPrivilegeValueW
AdjustTokenPrivileges

user32

wsprintfW
GetDesktopWindow
MessageBoxW

kernel32

EnumSystemLocalesW
SetStdHandle
ReadConsoleW
GetStringTypeW
LoadLibraryExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
GlobalFree
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
EnterCriticalSection
GetLastError
LeaveCriticalSection
SetLastError
GetVersionExW
FindFirstFileW
FindClose
FindNextFileW
GetFileAttributesW
OutputDebugStringW
GetLocalTime
GetTempPathW
GetCurrentProcess
CloseHandle
InitializeCriticalSection
SetEvent
WaitForSingleObject
DeleteCriticalSection
GetComputerNameW
CreateEventW
CreateThread
CreatePipe
SetHandleInformation
CreateProcessW
CreateFileW
GetExitCodeProcess
TerminateThread
WriteFile
ReadFile
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FlushFileBuffers
DeleteFileA
GetFileAttributesA
Sleep
CreateDirectoryW
K32EnumProcesses
OpenProcess
GlobalAlloc
GlobalLock
GlobalUnlock
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
HeapSize
SetFilePointerEx
EncodePointer
DecodePointer
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetModuleFileNameW
GetConsoleCP
GetConsoleMode

ole32

CoCreateGuid
StringFromGUID2

wininet

InternetCloseHandle
HttpQueryInfoW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW

Exports

Exports

InitializePrintMonitor2

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac193a207932337068c68e7b70e237ec

Headers

DLL Characteristics

File Characteristics

Imports

userenv

winspool.drv

advapi32

user32

kernel32

ole32

wininet

Exports

Exports

Sections

.text Size: 146KB - Virtual size: 146KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 10KB - Virtual size: 20KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 496B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 146KB - Virtual size: 146KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 10KB - Virtual size: 20KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 496B

.reloc
Size: 3KB - Virtual size: 2KB