Medusa[.]uno_JC[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Medusa.uno_JC.dll
Size

2.2MB
MD5

6dff3714b10fcc6d4ddee58009e343b2
SHA1

c54eaf8373151d8c5ed604610fdb8cd49159ad3e
SHA256

bcd7a153c91dc7932937a16e9f041abe310d1304bfff5523198f867a9c5689bc
SHA512

68836b76fce94171ed59bb99466a364a8066bad70326c4302f42a80037159707e6d0c5dfcbd01c4f1c38f3d5f4b538d074533dfee017df03c4d4ca599011eaec
SSDEEP

49152:cwXPFPCc/6Kkg3TPOeKScYZA67Cxct7/vRyci6d+y99E0u:pPOeKSc0A6R/vRysdA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Medusa.uno_JC.dll

Files

Medusa.uno_JC.dll
.dll windows:6 windows x86

c1a3f6e5b19511d2f58998ec5c192ded

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

ShellExecuteA
SHGetKnownFolderPath
ShellExecuteW

ole32

CoTaskMemFree

winmm

PlaySoundA

user32

ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
LoadCursorA
SetClipboardData
GetWindowThreadProcessId
CallWindowProcW
MessageBoxA
EnumWindows
SetWindowLongW
GetWindowTextLengthA
GetWindowTextW
ShowWindow
FindWindowW
FlashWindowEx
GetDC
GetKeyState
GetClipboardData

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStdHandle
SetFilePointerEx
GetFileSizeEx
GetModuleFileNameW
ReadFile
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
WideCharToMultiByte
CreateDirectoryA
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
SetPriorityClass
DisableThreadLibraryCalls
GetPriorityClass
lstrlenW
FreeLibraryAndExitThread
GetModuleHandleA
Process32NextW
Process32FirstW
CreateThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryW
QueryPerformanceFrequency
QueryPerformanceCounter
K32GetModuleInformation
LocalFree
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
ReadConsoleW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
SetEndOfFile
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetFileType
SetStdHandle
GetTimeZoneInformation
GetACP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
CreateDirectoryW
WaitForSingleObjectEx
RaiseException
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetDriveTypeW

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

gdi32

AddFontMemResourceEx
RemoveFontMemResourceEx
CreateFontA
SelectObject
CreateCompatibleDC
EnumFontFamiliesExW
CreateFontW
DeleteDC
GetFontData
DeleteObject

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1a3f6e5b19511d2f58998ec5c192ded

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ole32

winmm

user32

kernel32

imm32

gdi32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 244KB - Virtual size: 243KB

.data Size: 112KB - Virtual size: 1.9MB

.reloc Size: 73KB - Virtual size: 73KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 244KB - Virtual size: 243KB

.data
Size: 112KB - Virtual size: 1.9MB

.reloc
Size: 73KB - Virtual size: 73KB