848384d4522bfa077d88a74da8278790b9786b2a92361ff79ab0156cd9a60742

Sharing

Copy URL

Twitter E-mail

General

Target

848384d4522bfa077d88a74da8278790b9786b2a92361ff79ab0156cd9a60742
Size

3.8MB
MD5

ce02f938cbc32f787a80e87d2d23827a
SHA1

afb920983c2d60894bc52035b0c42397c9b59d1d
SHA256

848384d4522bfa077d88a74da8278790b9786b2a92361ff79ab0156cd9a60742
SHA512

911506f8bbe593a38bc40eed9e977b092441a1f2ae445176c0044951214b89f764738c70bde1b7bf91f0929ff702e1573bea2ecdd97dbeeb87f2beb12c209b30
SSDEEP

98304:LXLIiM1LunTZa+LGnd2emdf2pLSaHlyt+ARTI:LXgyn1GUTwLSolytp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
848384d4522bfa077d88a74da8278790b9786b2a92361ff79ab0156cd9a60742

Files

848384d4522bfa077d88a74da8278790b9786b2a92361ff79ab0156cd9a60742
.dll windows:5 windows x86

8ac5044109fbc61274ea1c57c930c48c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
accept
listen
ioctlsocket
gethostname
shutdown
htonl
WSACleanup
getservbyname
gethostbyname
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
WSAStartup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
getsockopt

wldap32

ord79
ord22
ord211
ord143
ord50
ord26
ord30
ord200
ord32
ord35
ord45
ord46
ord41
ord27
ord301
ord33

kernel32

WideCharToMultiByte
GetFileType
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
GetLocalTime
CreateFileA
FreeLibrary
WaitForSingleObject
GetSystemDirectoryW
GetLocaleInfoW
GetSystemWow64DirectoryW
GetVersionExW
GetFileAttributesW
GetTempPathW
GetModuleFileNameA
GetUserDefaultUILanguage
FindFirstFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
lstrcmpA
LocalAlloc
FileTimeToLocalFileTime
LocalFree
lstrcpyW
WTSGetActiveConsoleSessionId
DeleteFileA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
SleepEx
GetCurrentThreadId
GetModuleHandleA
GetVersion
GetStdHandle
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
WriteFile
SystemTimeToFileTime
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateTimerQueue
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
GetFileInformationByHandle
LoadLibraryExW
SetConsoleCtrlHandler
AreFileApisANSI
GetModuleHandleExW
GetCPInfo
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
ResumeThread
ExitThread
GetFileAttributesExW
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
GetStringTypeW
GetCurrentThread
GetSystemTimeAsFileTime
lstrlenA
lstrcpynW
GlobalFree
GlobalLock
GlobalAlloc
ReadFile
GetFileSize
CreateFileW
GetACP
MultiByteToWideChar
LockResource
SizeofResource
FlushConsoleInputBuffer
FreeResource
LoadResource
FindResourceW
SetFilePointer
DosDateTimeToFileTime
GlobalUnlock
MulDiv
SetEndOfFile
GetFullPathNameW
SetEnvironmentVariableA
WriteConsoleW
GetDriveTypeW
FindFirstFileExW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetModuleHandleW
GetProcAddress
GetCurrentDirectoryW
GetModuleFileNameW
LoadLibraryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OutputDebugStringW
OutputDebugStringA
CreateThread
DeleteFileW
GetLogicalDriveStringsW
CreateDirectoryW
ExitProcess
WinExec
TerminateProcess
OpenProcess
GetCurrentProcess
Sleep
DecodePointer
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
FlushFileBuffers
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
HeapSize
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
GetThreadTimes
FreeLibraryAndExitThread
IsValidCodePage
GetOEMCP
GetConsoleCP
SwitchToThread

user32

CreateAcceleratorTableW
FindWindowW
SetWindowPos
SetTimer
KillTimer
GetMessageW
DispatchMessageW
TranslateMessage
ShowWindow
SendMessageW
wsprintfW
EnableWindow
GetKeyState
DestroyWindow
ReleaseDC
InvalidateRgn
CharPrevW
SetRect
DrawTextW
FillRect
GetWindowRgn
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
MapWindowPoints
GetCaretPos
GetSysColor
GetDC
GetClientRect
GetWindowLongW
GetCaretBlinkTime
SetCaretPos
CreateCaret
GetFocus
IntersectRect
GetWindow
SetFocus
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
IsIconic
UnionRect
GetWindowRect
UpdateLayeredWindow
InvalidateRect
CreateWindowExW
ScreenToClient
GetCursorPos
IsWindow
SetCapture
ReleaseCapture
PostMessageW
PtInRect
GetParent
MoveWindow
IsZoomed
GetMonitorInfoW
MonitorFromWindow
SetWindowRgn
MessageBoxW
DefWindowProcW
LoadImageW
GetUserObjectInformationW
GetProcessWindowStation
GetSystemMetrics
LoadCursorW
ClientToScreen
HideCaret
ShowCaret
CharNextW
SetCursor
InflateRect
OffsetRect
MessageBoxA
SetWindowLongW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
TrackMouseEvent
SetPropW
GetPropW
AdjustWindowRectEx
GetMenu
RegisterClassW

gdi32

SelectClipRgn
PtInRegion
CreateRectRgn
CreateSolidBrush
SetTextColor
SetBkMode
GetDeviceCaps
CreateRoundRectRgn
GetTextMetricsW
BitBlt
CreateCompatibleBitmap
RestoreDC
SaveDC
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
CreatePen
CreateFontIndirectW
GetStockObject
GetObjectW
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
StretchBlt
SetStretchBltMode
CreatePenIndirect
LineTo
Rectangle
RoundRect
GetObjectA
SetBkColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
CombineRgn
MoveToEx

advapi32

RegCreateKeyExA
RegSetValueExA
RegCreateKeyExW
RegSetValueExW
ConvertSidToStringSidW
RegDeleteValueW
RegOpenKeyExA
LookupAccountNameW
RegDeleteKeyW
RegQueryValueExA
RegCreateKeyW
RevertToSelf
ImpersonateLoggedOnUser
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameW
RegEnumKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegOpenKeyA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegQueryInfoKeyA

shell32

SHFileOperationW
SHBrowseForFolderW
ord155
ShellExecuteW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteExW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
PropVariantClear
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CLSIDFromProgID
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

gdiplus

GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth
GdipGetImageHeight
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipImageGetFrameDimensionsCount
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangleI
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipMeasureString
GdipDrawString
GdiplusShutdown
GdipCreateSolidFill
GdiplusStartup

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

comctl32

_TrackMouseEvent
ord17

shlwapi

PathFileExistsW
SHStrDupW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

userenv

UnloadUserProfile
GetUserProfileDirectoryW
LoadUserProfileW

crypt32

CryptMsgClose
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptDecodeObject

psapi

GetModuleBaseNameA

wtsapi32

WTSQueryUserToken

Exports

Exports

AddMenuAction
AddSubMenuAction
CheckSignStats
CheckUninstallFlash
ControlBindNSISScript
CurrentUserIsLocalSystem
DeleteFCShortCut
DeleteHKCUReg
DeleteMenuAction
DeleteNsisShortCut
ExitNsDui
FCAesEncryptString
FindControl
GetApplicationLocale
GetCheckBoxStatus
GetCurrentUserPath
GetCustGameCount
GetFlashCenterInstallPath
GetFlashInstallPath
GetInstallDir
GetMacValue
GetOSVersion
GetTimeStamp
GetUUIDAndMacAndCPU
GetUrlId
IEOpenUrl
InitReg
InitWnd
InstallSvc
IsChineseSimpleLang
PinTaskbar_1809
ResetDefaultApp
SelectInstallDir
SetCheckBoxStatus
SetCountParam
SetDefaultApp
SetDefaultOpenProg
SetInstallDir
SetInstallSpaceInfo
SetProgressValue
SetVersion
ShowMainWnd
UninstallHS
UnstallGames
UpdateShortcutLink
WriteHKCUReg
WriteSettingXml
WriteShortcutsSettingXml
compareVersion
nsDuiSendMessage
startProgress
stopProgress

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 407KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ac5044109fbc61274ea1c57c930c48c

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

imm32

comctl32

shlwapi

version

wininet

iphlpapi

userenv

crypt32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 407KB - Virtual size: 407KB

.data Size: 53KB - Virtual size: 82KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 86KB - Virtual size: 86KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 407KB - Virtual size: 407KB

.data
Size: 53KB - Virtual size: 82KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 86KB - Virtual size: 86KB