e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009

Sharing

Copy URL

Twitter E-mail

General

Target

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009
Size

2.8MB
MD5

f2aefe9be195cd38df050f7e2a691d1c
SHA1

dc496ff722716cef6812d5d753323f297ace9c96
SHA256

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009
SHA512

dc932054ee0ef77d42c7983fb0d7b931b7aedf31401a0f655fc34bd0b443c92f2f6f01107b8a7e1151296ef5e724586c23809dce6f8d19b77b28b095b3eb1cf3
SSDEEP

49152:88bvd1uf1VJM7NnaUhEehiArugE+T5i9F8n/Y5X8Tl/TjEccFsUVUP3OO0:TbFgf1DsaUhEgiAKx0i9Fm/xEccsP3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009

Files

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009
.dll windows:5 windows x86

d6ed743c1613db95ce8ec2ee5d7a28c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryDosDeviceW
GetSystemTime
GetVolumeInformationW
GetThreadTimes
lstrlenA
GetFileSizeEx
GetTimeFormatW
GetFileAttributesA
SizeofResource
GetPrivateProfileStringW
LoadResource
FindResourceW
LoadLibraryA
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetErrorMode
DeviceIoControl
SetEnvironmentVariableA
GetFullPathNameA
WriteConsoleW
SetStdHandle
ReadConsoleW
HeapQueryInformation
SetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetConsoleMode
GetConsoleCP
FindResourceExW
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetTimeZoneInformation
SetConsoleCtrlHandler
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateSemaphoreW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FatalAppExitA
GetDriveTypeW
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
SetFileTime
ExitThread
CreateThread
GetFullPathNameW
IsDebuggerPresent
GetCommandLineA
AreFileApisANSI
ExitProcess
EncodePointer
GetSystemTimeAsFileTime
GetStringTypeW
CreateFileA
GetDiskFreeSpaceW
GlobalMemoryStatusEx
GetThreadPriority
CreatePipe
SetEndOfFile
FreeResource
GetTempFileNameW
GetDateFormatW
IsDBCSLeadByte
FormatMessageW
GetCPInfo
GetFileTime
ReadFile
GetFileAttributesW
CreateDirectoryW
lstrcpynA
SetFilePointer
GetFileSize
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetSystemInfo
GetComputerNameW
FreeLibrary
SetFileAttributesW
GetWindowsDirectoryW
DeleteCriticalSection
DecodePointer
RemoveDirectoryW
HeapSize
GetCurrentDirectoryW
RaiseException
GlobalUnlock
CreateFileW
HeapDestroy
CopyFileW
InitializeCriticalSectionAndSpinCount
WriteFile
GetProcessHeap
GlobalLock
HeapFree
MoveFileExW
HeapAlloc
HeapReAlloc
DeleteFileW
FindNextFileW
FindClose
GetTempPathW
lstrlenW
GetSystemDirectoryW
GetTickCount
FindFirstFileW
SetProcessWorkingSetSize
OpenThread
SetThreadPriorityBoost
GetStartupInfoW
SetThreadPriority
Thread32Next
GetExitCodeProcess
ReadProcessMemory
Thread32First
GetPriorityClass
SetProcessPriorityBoost
GetCurrentThread
GetProcessPriorityBoost
SetPriorityClass
GetThreadIOPendingFlag
IsWow64Process
SystemTimeToFileTime
VerifyVersionInfoW
VerSetConditionMask
MoveFileW
LocalFree
InterlockedIncrement
InterlockedDecrement
QueryPerformanceFrequency
QueryPerformanceCounter
ResetEvent
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
GetPrivateProfileIntW
GetModuleHandleExW
IsProcessorFeaturePresent
LocalAlloc
LocalLock
LocalUnlock
LoadLibraryExW
CreateFileMappingW
GlobalReAlloc
MulDiv
OutputDebugStringA
GetCurrentThreadId
OpenEventW
OpenFileMappingW
GetModuleFileNameA
EnterCriticalSection
SetLastError
LeaveCriticalSection
InitializeCriticalSection
OutputDebugStringW
SetEvent
VirtualQuery
UnmapViewOfFile
MapViewOfFile
FileTimeToLocalFileTime
LockResource
GetLocalTime
FindFirstFileExW
CreateProcessW
GetVersionExW
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
GetModuleHandleW
GetProcAddress
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
lstrcpynW
lstrcmpiW
CloseHandle
GetLastError
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GlobalAlloc
Sleep
InterlockedCompareExchange
InterlockedExchange
lstrcpyW
FlushFileBuffers
GlobalFree

user32

DestroyMenu
GetClassInfoW
CreateWindowExW
DefWindowProcW
MapWindowPoints
GetWindow
PeekMessageW
DrawFocusRect
SendMessageW
GetParent
GetCaretPos
InflateRect
GetSystemMenu
GetWindowTextW
SetWindowLongW
RedrawWindow
GetActiveWindow
SetWindowRgn
IsZoomed
SystemParametersInfoW
GetAncestor
EnableWindow
CallNextHookEx
RegisterClassExW
GetSubMenu
DestroyIcon
PrivateExtractIconsW
LoadStringW
SetWindowsHookExW
UnhookWindowsHookEx
DrawTextW
GetMenuItemInfoW
MessageBoxA
FillRect
GetWindowThreadProcessId
MonitorFromPoint
SetRectEmpty
EqualRect
GetMenuState
DrawIconEx
GetClassInfoExW
GetClassNameW
GetFocus
GetMonitorInfoW
GetMenuItemCount
SetMenuItemInfoW
IsMenu
SetMenuInfo
GetMenuInfo
GetSysColor
IsWindow
MoveWindow
GetWindowRect
LoadCursorW
PostMessageW
ShowWindow
GetDlgItem
FindWindowExW
CharUpperBuffW
EnumWindows
GetIconInfo
GetForegroundWindow
EnumChildWindows
GetShellWindow
SetDlgItemTextW
CallWindowProcW
DestroyWindow
SetWindowPos
SetWindowTextW
PostQuitMessage
GetDlgItemTextW
GetSystemMetrics
UpdateWindow
SetRect
GetDesktopWindow
LoadImageW
ExitWindowsEx
SetClipboardData
OpenClipboard
EmptyClipboard
UnregisterClassW
CloseClipboard
DispatchMessageW
TranslateMessage
GetMessageW
FindWindowA
SendMessageTimeoutW
PtInRect
OffsetRect
IntersectRect
ReleaseDC
GetDC
SetCapture
ReleaseCapture
GetCapture
GetKeyState
SetTimer
KillTimer
GetWindowLongW
RegisterWindowMessageW
GetClientRect
UnionRect
InvalidateRect
IsRectEmpty
BeginPaint
EndPaint
UpdateLayeredWindow
IsWindowVisible
CreateCaret
ShowCaret
HideCaret
SetCaretPos
SetCursor
SetFocus
ScreenToClient
GetCursorPos
ClientToScreen
WindowFromPoint
TrackMouseEvent
GetUserObjectInformationW
IsHungAppWindow
GetThreadDesktop
DeleteMenu

gdi32

GetCurrentObject
GetTextExtentExPointW
TextOutW
PatBlt
LPtoDP
CreateBitmap
SelectClipRgn
SetRectRgn
CreateRectRgnIndirect
DPtoLP
Polyline
RectVisible
ExtCreatePen
GetBkMode
CreatePenIndirect
SaveDC
SetStretchBltMode
GetStretchBltMode
GetTextColor
RestoreDC
CreatePatternBrush
CreateSolidBrush
GetDIBits
RealizePalette
SelectPalette
CreateDCW
GetTextExtentPoint32W
GetObjectA
CombineRgn
ExtCreateRegion
StretchBlt
SetTextColor
SetViewportOrgEx
Rectangle
LineTo
MoveToEx
ExtTextOutW
SetBkColor
GetTextMetricsW
GetDeviceCaps
GetObjectW
CreateFontIndirectW
CreateRectRgn
ExcludeClipRect
BitBlt
CreateCompatibleBitmap
GetClipBox
RoundRect
CreatePen
SetBkMode
GetStockObject
SelectObject
CreateDIBSection
DeleteDC
CreateCompatibleDC
DeleteObject
CreateDCA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
GetUserNameW
RegQueryValueExW
GetLengthSid
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
InitializeAcl
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetSecurityDescriptorSacl
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetAce
GetSidLengthRequired
InitializeSid
AddAce
GetFileSecurityW
DuplicateToken
MapGenericMask
AccessCheck
GetSecurityDescriptorDacl
GetAclInformation
LookupAccountSidW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
CryptEncrypt
RegGetKeySecurity
RegSetKeySecurity
ConvertStringSidToSidW
RegEnumKeyW
RegOpenKeyW
RegQueryInfoKeyW
CloseServiceHandle
DeleteService
OpenSCManagerW
EnumDependentServicesW
OpenServiceW
QueryServiceConfig2W
ChangeServiceConfig2W
StartServiceW
ChangeServiceConfigW
QueryServiceStatusEx
ControlService
QueryServiceConfigW
CryptAcquireContextA
CryptGenRandom
SetEntriesInAclW
CreateServiceW
QueryServiceStatus
GetTokenInformation
ConvertSidToStringSidW
CryptGetHashParam
CryptImportKey
CryptSetKeyParam

shell32

SHChangeNotify
ord51
SHGetDesktopFolder
SHGetFileInfoW
ExtractIconExW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteExW
SHCreateDirectoryExW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW
ord165
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoInitialize
IIDFromString
StringFromIID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateGuid

oleaut32

CreateErrorInfo
SysAllocString
VariantClear
SysAllocStringByteLen
VariantInit
VarBstrCmp
SysStringByteLen
VariantChangeType
GetErrorInfo
SafeArrayGetUBound
SafeArrayGetElement
VariantTimeToSystemTime
SetErrorInfo
SafeArrayGetLBound
SysFreeString
SysAllocStringLen
SysStringLen
OleCreatePictureIndirect

shlwapi

PathStripToRootW
wnsprintfW
StrTrimW
StrCmpNIA
StrStrIA
StrChrA
PathRemoveBackslashW
PathStripPathW
StrStrW
PathFindFileNameW
UrlIsW
SHDeleteKeyW
StrRChrW
StrCpyNW
PathAddBackslashW
PathIsDirectoryW
StrRChrIW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW

version

GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessMemoryInfo
GetModuleBaseNameW
EnumProcesses

msimg32

AlphaBlend

imm32

ImmAssociateContext
ImmGetDefaultIMEWnd
ImmGetContext
ImmReleaseContext

gdiplus

GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillPath
GdipFillPieI
GdipDrawPath
GdipDrawArcI
GdipDrawLineI
GdipSetInterpolationMode
GdipAddPathString
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetPenDashArray
GdipLoadImageFromStreamICM
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImagePointsI
GdipDrawImageRectI
GdipLoadImageFromFileICM
GdipDrawString
GdipGetImageGraphicsContext
GdipDisposeImage
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdiplusShutdown
GdiplusStartup
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipGetImageWidth
GdipFillRectangleI
GdipDrawRectangleI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipLoadImageFromStream
GdipGetImageRawFormat
GdipSetStringFormatLineAlign
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipSetTextRenderingHint
GdipMeasureString
GdipGetImageThumbnail
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel
GdipDrawImageRectRect
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGraphicsClear
GdipLoadImageFromFile
GdipGetPropertyItem
GdipSetPenWidth
GdipSetWorldTransform

ntdll

NtClose
NtQuerySystemInformation
NtQueryInformationProcess
NtSuspendProcess
NtSetSystemInformation
RtlUnwind
RtlNtPathNameToDosPathName
RtlInitUnicodeString
NtCreatePagingFile
NtDuplicateObject
NtUnlockVirtualMemory
NtOpenProcess
NtLockVirtualMemory
NtSetInformationProcess
NtResumeProcess
NtTerminateProcess
RtlNtStatusToDosError

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

ws2_32

__WSAFDIsSet
getpeername
WSAIoctl
connect
WSAGetLastError
htons
select
getsockname
setsockopt
getsockopt
WSAStartup
WSAEventSelect
WSACleanup
ioctlsocket
send
freeaddrinfo
getaddrinfo
htonl
ntohl
ntohs
WSASetLastError
socket
bind
recv
closesocket

dbghelp

MiniDumpWriteDump

netapi32

Netbios
NetWkstaTransportEnum
NetApiBufferFree

wininet

GetUrlCacheEntryInfoExW

Exports

Exports

AbortInstall
CreateInstallWnd
DirLeave
DoUnAdData
ExitWork
GeProtectStartState
GetAppdataLocalLow
GetAutoStartState
GetCheckBoxStatus
GetInstallSvrState
GetTNFromPackageName
HideWindow
InitInstallHelper
InitUnInstallHelper
KillProcess
NewNsisWndProc
NotifyHostSetupStatus
NotifyInstallStatus
RegisterExt
ReportSilentInstall
UnRegisterExt
UninitInstallHelper
UninstallWebAdapter
WriteMustRebootTag

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 427KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6ed743c1613db95ce8ec2ee5d7a28c5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

msimg32

imm32

gdiplus

ntdll

mpr

ws2_32

dbghelp

netapi32

wininet

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 427KB - Virtual size: 427KB

.data Size: 57KB - Virtual size: 87KB

.rsrc Size: 199KB - Virtual size: 199KB

.reloc Size: 115KB - Virtual size: 114KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 427KB - Virtual size: 427KB

.data
Size: 57KB - Virtual size: 87KB

.rsrc
Size: 199KB - Virtual size: 199KB

.reloc
Size: 115KB - Virtual size: 114KB