81c4ccf5c5d788b8b9fde867c66b210b78cbdfe1e02d20e0bce205eaac252f68

Sharing

Copy URL

Twitter E-mail

General

Target

81c4ccf5c5d788b8b9fde867c66b210b78cbdfe1e02d20e0bce205eaac252f68
Size

6.4MB
MD5

bbc6c7bde8c7c3c358d765d5d3bcd1ed
SHA1

b45ab4abd294a1c55740e17088bf703191bc71c5
SHA256

81c4ccf5c5d788b8b9fde867c66b210b78cbdfe1e02d20e0bce205eaac252f68
SHA512

95cecd59ea1f486d0e3e0c09a9542bfe7c37998b3fb6a0bd9c28946b74ba8d179c3a4e58202120c895d733b5c0ae320adb4513c94a99b0e6d42013d03e10680a
SSDEEP

98304:RE9IdX2ULdxAx5u8NKVXIoQt9ltlfAWABZXe9Latz/83sv4Uoanv+j29:xFL/05urDQptlfse9waitoamQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81c4ccf5c5d788b8b9fde867c66b210b78cbdfe1e02d20e0bce205eaac252f68

Files

81c4ccf5c5d788b8b9fde867c66b210b78cbdfe1e02d20e0bce205eaac252f68
.dll windows:6 windows x64

7fe4d9fd2dc211014b2729717e05dd5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

bind
WSAStartup
WSACleanup
freeaddrinfo
closesocket
WSAGetLastError
getsockopt
recv
WSARecv
listen
WSASend
getsockname
send
accept
select
connect
getaddrinfo
WSASocketW
getpeername
ioctlsocket
setsockopt

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
SystemFunction036

ntdll

RtlCaptureContext
RtlVirtualUnwind
NtWriteFile
RtlNtStatusToDosError
RtlLookupFunctionEntry

bcrypt

BCryptGenRandom

vulkan-1

vkDestroyImage
vkDestroyImageView
vkGetBufferMemoryRequirements
vkDestroyShaderModule
vkDestroyPipeline
vkBindBufferMemory
vkFlushMappedMemoryRanges
vkUnmapMemory
vkDestroyPipelineLayout
vkMapMemory
vkFreeMemory
vkDestroySampler
vkAllocateMemory
vkDestroyDescriptorSetLayout
vkCmdBindPipeline
vkCmdSetViewport
vkCmdSetScissor
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkGetPhysicalDeviceMemoryProperties
vkCmdBindVertexBuffers
vkGetDeviceQueue
vkGetPhysicalDeviceQueueFamilyProperties
vkCmdDrawIndexed
vkDestroyBuffer
vkCreateBuffer
vkCmdPushConstants

kernel32

GetSystemDirectoryW
CreateNamedPipeW
GetFullPathNameW
GetModuleFileNameW
FormatMessageW
CreateProcessW
GetFileAttributesW
WriteConsoleW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetWindowsDirectoryW
InitializeSListHead
RaiseException
CreateFileW
CreateMutexA
WaitForSingleObjectEx
AcquireSRWLockShared
GetProcessHeap
SleepConditionVariableSRW
WakeAllConditionVariable
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
ReadFileEx
SleepEx
WriteFileEx
SetHandleInformation
DuplicateHandle
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
GetCurrentThread
SetThreadStackGuarantee
CompareStringOrdinal
ReleaseSRWLockShared
ReleaseMutex
FreeEnvironmentStringsW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
WriteFile
GetStdHandle
GetDynamicTimeZoneInformation
GetFileAttributesA
VirtualQuery
VirtualFree
K32EnumProcessModules
GetCurrentProcess
GetProcAddress
Sleep
DisableThreadLibraryCalls
CreateThread
CloseHandle
GetModuleHandleA
LoadLibraryA
GetModuleHandleExA
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DecodePointer
HeapAlloc
RtlUnwindEx
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
GetClientRect
GetForegroundWindow
SetCursorPos
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
GetKeyState
CharUpperBuffW

msvcp140

?_Syserror_map@std@@YAPEBDH@Z
_Cnd_signal
_Cnd_destroy_in_situ
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Xtime_get_ticks
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
_CxxThrowException
__CxxFrameHandler3
__C_specific_handler
__current_exception
memmove
__std_type_info_destroy_list
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
memcpy
_purecall
__std_terminate
memset
__current_exception_context
__std_exception_copy
memchr
strstr
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_errno
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

atof
mbstowcs
strtoll
strtol
strtod

api-ms-win-crt-stdio-l1-1-0

fputs
_fsopen
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
fflush
_wfopen
fread
fseek
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfprintf
ftell
_wfopen_s
fclose

api-ms-win-crt-string-l1-1-0

strcat_s
toupper
isdigit
strncmp
strncpy
strcmp
strlen
strcpy_s

api-ms-win-crt-math-l1-1-0

cosf
ceilf
acosf
sqrtf
fmodf
logf
_dsign
_fdsign
pow
powf
log
_ldsign
_dclass
_fdclass
sinf
_ldclass
log2f

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s
strftime
_gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir

Exports

Exports

CreateDXGIFactory
CreateDXGIFactory1
CreateDXGIFactory2
DESCRIPTION
DXGIDeclareAdapterRemovalSupport
DXGIGetDebugInterface1
GetFileVersionInfoA
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
NAME
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Fci
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Y!-
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DGn
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fe4d9fd2dc211014b2729717e05dd5f

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

ntdll

bcrypt

vulkan-1

kernel32

user32

msvcp140

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 3.0MB

.rdata Size: - Virtual size: 1.5MB

.data Size: - Virtual size: 24KB

.pdata Size: - Virtual size: 153KB

.Fci Size: - Virtual size: 2.9MB

.Y!- Size: 4KB - Virtual size: 4KB

.DGn Size: 6.4MB - Virtual size: 6.4MB

.reloc Size: 512B - Virtual size: 232B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 3.0MB

.rdata
Size: - Virtual size: 1.5MB

.data
Size: - Virtual size: 24KB

.pdata
Size: - Virtual size: 153KB

.Fci
Size: - Virtual size: 2.9MB

.Y!-
Size: 4KB - Virtual size: 4KB

.DGn
Size: 6.4MB - Virtual size: 6.4MB

.reloc
Size: 512B - Virtual size: 232B

.rsrc
Size: 1KB - Virtual size: 1KB