7e9f77a226ea6c9a40b3b22e13e3fd835fade95a90bd3f670db27c8241d5db88

Sharing

Copy URL Twitter E-mail

General

Target

7e9f77a226ea6c9a40b3b22e13e3fd835fade95a90bd3f670db27c8241d5db88
Size

5.6MB
MD5

ca73916e235d318172ca48b7f3709fe0
SHA1

fc809f9f07bc46065a1a915ea59ebfb1687994c0
SHA256

7e9f77a226ea6c9a40b3b22e13e3fd835fade95a90bd3f670db27c8241d5db88
SHA512

e7e569f572162d8228db81c4dd57bf111ae4272a08bb38c5a01eed3d3637db595b40c5d2d1afc7be2e678a054ceff8e524893b7dc9fbf5649a678fd130b20764
SSDEEP

98304:7tNdf5DZ7Q3u+C5kJZfFHr9VVWBhaOCOHgmzfRveAu3J:7ZflZ7Q3u+CqNHrqHdVeAuZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e9f77a226ea6c9a40b3b22e13e3fd835fade95a90bd3f670db27c8241d5db88

Files

7e9f77a226ea6c9a40b3b22e13e3fd835fade95a90bd3f670db27c8241d5db88
.dll windows:6 windows x86

9c13dc15210bbacefc163a4f44a502ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
Sleep
GetLocalTime
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetTickCount64
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
ConnectNamedPipe
WaitNamedPipeW
GetOverlappedResult
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
GetConsoleCP
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetModuleFileNameA
SetConsoleCtrlHandler
ExitThread
GetTimeZoneInformation
ExitProcess
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
DisconnectNamedPipe
CreateNamedPipeW
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryW
SetCurrentDirectoryA
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SizeofResource
GetModuleHandleW
GetProcAddress
ResetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetExitCodeThread
GetCurrentThread
DuplicateHandle
IsDebuggerPresent
TerminateThread
SetWaitableTimer
LocalFree
CloseHandle
GetSystemTimeAsFileTime
lstrlenW
WinExec
GlobalAlloc
GlobalFree
CreatePipe
GetStartupInfoW
CreateProcessW
ReadFile
GetExitCodeProcess
GetSystemInfo
LoadLibraryW
FreeLibrary
DeleteFileW
CreateFileW
WriteFile
FreeResource
VirtualQuery
GetModuleFileNameW
WaitForSingleObject
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
Process32NextW
OpenProcess
GetSystemDirectoryW
GetEnvironmentVariableW
GetFileSize
VirtualAlloc
VirtualFree
GetWindowsDirectoryW
CopyFileW
PeekNamedPipe
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
GetVersionExW
GetNativeSystemInfo
CreateEventW
WaitForMultipleObjects
SetEvent
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
RemoveDirectoryW
GetTempPathW
CreateDirectoryW
MoveFileExW
MoveFileW
CreateDirectoryA
ExpandEnvironmentStringsW
GetFileSizeEx
GetPrivateProfileStringW
GetSystemTime
DeviceIoControl
lstrcatW
GlobalMemoryStatusEx
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
FormatMessageW
GetFileAttributesExW
SetConsoleTextAttribute
GetStdHandle
GetPrivateProfileIntW
CreateMutexW
GetCurrentThreadId
ReleaseMutex
ResumeThread
SetThreadPriority
SetUnhandledExceptionFilter
CreateThread
SetLastError
SetFilePointer
FlushFileBuffers
LoadLibraryExW
CreateFileA
ProcessIdToSessionId
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
OutputDebugStringW
GetSystemFirmwareTable
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
LoadLibraryA
FormatMessageA
GetFileType
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
WaitForSingleObjectEx
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
TryEnterCriticalSection
GetModuleHandleExW
VirtualProtect
GetACP
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
lstrcpynW
GetBinaryTypeW
CreateWaitableTimerW
GetFileInformationByHandleEx

user32

MoveWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
FlashWindowEx
PostMessageW
ShowWindow
SetForegroundWindow
GetUserObjectInformationW
GetProcessWindowStation
KillTimer
CreateWindowExW
RegisterClassW
wsprintfW
SystemParametersInfoW
GetIconInfo
GetDC
ReleaseDC
FindWindowW
DestroyIcon
IsWindow
SendMessageW
MessageBoxW

advapi32

RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
OpenServiceW
QueryServiceStatus
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegFlushKey
ControlService
CloseServiceHandle
StartServiceW
RegEnableReflectionKey
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegDeleteValueW
RegDeleteKeyW

shell32

SHCreateDirectoryExW
ShellExecuteExW
ExtractIconExW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHFileOperationW
SHBrowseForFolderW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW

oleaut32

VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantClear
SysAllocString
SysFreeString
VariantInit

ws2_32

getservbyport
setsockopt
socket
connect
ioctlsocket
shutdown
getsockopt
ntohs
gethostbyname
WSAStartup
WSACleanup
WSAGetLastError
htonl
htons
inet_addr
inet_ntoa
gethostbyaddr
closesocket
getservbyname
WSASetLastError
recv
send

libcurl

curl_easy_getinfo
curl_multi_cleanup
curl_multi_remove_handle
curl_multi_wait
curl_multi_info_read
curl_multi_perform
curl_multi_add_handle
curl_multi_setopt
curl_multi_init
curl_easy_cleanup
curl_slist_free_all
curl_easy_perform
curl_slist_append
curl_easy_setopt
curl_easy_init

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CertGetCertificateContextProperty
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertCloseStore

shlwapi

PathIsDirectoryW
PathFindFileNameW
PathFindExtensionW
PathAppendW
PathIsDirectoryA
PathRemoveExtensionW
PathAddExtensionW
PathFileExistsW
PathRemoveFileSpecW

rpcrt4

UuidToStringA
RpcStringFreeA

gdiplus

GdiplusStartup
GdipCreateBitmapFromHICON
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageHeight
GdipGetImageWidth
GdipBitmapGetPixel
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipSaveImageToFile
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapSetPixel

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

wininet

InternetOpenW
InternetQueryDataAvailable
InternetReadFile
HttpSendRequestW
InternetGetConnectedStateExW
InternetAttemptConnect
InternetConnectW
InternetSetOptionW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestExW
InternetWriteFile
InternetCloseHandle
HttpEndRequestW
HttpQueryInfoW
InternetQueryOptionW

dxgi

CreateDXGIFactory1

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW

bcrypt

BCryptGenRandom

gdi32

GetObjectW
DeleteObject
GetDeviceCaps

comdlg32

GetOpenFileNameW

ole32

CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoCreateGuid
CoSetProxyBlanket
CoInitialize

Exports

Exports

CreateWebSocketPlugin
DownLoadSoftPolicy
fetchInstalledAppList
fetchLocalInstallAppInfo
fetchRarelyUsedSoftwareCount
fetchUninstallResidualInfo
fetchUpgradeCount
fetchUpgradeList
libscca_error_backtrace_fprint
libscca_error_backtrace_sprint
libscca_error_fprint
libscca_error_free
libscca_error_sprint
libscca_file_close
libscca_file_free
libscca_file_get_file_metrics_entry
libscca_file_get_format_version
libscca_file_get_last_run_time
libscca_file_get_number_of_file_metrics_entries
libscca_file_get_number_of_filenames
libscca_file_get_number_of_volumes
libscca_file_get_prefetch_hash
libscca_file_get_run_count
libscca_file_get_utf16_executable_filename
libscca_file_get_utf16_executable_filename_size
libscca_file_get_utf16_filename
libscca_file_get_utf16_filename_size
libscca_file_get_utf8_executable_filename
libscca_file_get_utf8_executable_filename_size
libscca_file_get_utf8_filename
libscca_file_get_utf8_filename_size
libscca_file_get_volume_information
libscca_file_initialize
libscca_file_metrics_free
libscca_file_metrics_get_file_reference
libscca_file_metrics_get_utf16_filename
libscca_file_metrics_get_utf16_filename_size
libscca_file_metrics_get_utf8_filename
libscca_file_metrics_get_utf8_filename_size
libscca_file_open
libscca_file_open_file_io_handle
libscca_file_open_wide
libscca_file_signal_abort
libscca_volume_information_free
libscca_volume_information_get_creation_time
libscca_volume_information_get_serial_number
libscca_volume_information_get_utf16_device_path
libscca_volume_information_get_utf16_device_path_size
libscca_volume_information_get_utf8_device_path
libscca_volume_information_get_utf8_device_path_size
releaseBuf
timerReportTask
timerUpdateInstallAppList

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c13dc15210bbacefc163a4f44a502ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

ws2_32

libcurl

crypt32

shlwapi

rpcrt4

gdiplus

wtsapi32

wininet

dxgi

iphlpapi

version

pdh

bcrypt

gdi32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 60KB - Virtual size: 81KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 256KB - Virtual size: 256KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 60KB - Virtual size: 81KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 256KB - Virtual size: 256KB