fe1d8797d6d5b7bd9370cdd0bb6011081c41032fcb22faf0957a3b0932e0800e

Sharing

Copy URL Twitter E-mail

General

Target

fe1d8797d6d5b7bd9370cdd0bb6011081c41032fcb22faf0957a3b0932e0800e
Size

1.7MB
MD5

2a61e8ae13b5d34ec69a4c6d3a4b9679
SHA1

3876d430bedc29ada6f1802b63c471fd59f1e93a
SHA256

fe1d8797d6d5b7bd9370cdd0bb6011081c41032fcb22faf0957a3b0932e0800e
SHA512

ed78a66754c27c95eb755704124eb8b2b7be27e82d783802c061e45e452934ddac399217508f3d976528302216a56cc0e4e20e6959bafea091a06942e8793f21
SSDEEP

49152:+DMRPr+USv1d/qOuIgcnyZpCKy87SQToeMTW2tiMns+V4SPpMAHf:+DMJ+dvH/7tg03si4qM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe1d8797d6d5b7bd9370cdd0bb6011081c41032fcb22faf0957a3b0932e0800e

Files

fe1d8797d6d5b7bd9370cdd0bb6011081c41032fcb22faf0957a3b0932e0800e
.dll windows:5 windows x86

3cdec25f8dbf4111450aafcc8d4d122e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTimeZoneInformation
GetProcessHeap
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetEndOfFile
DecodePointer
GetModuleFileNameA
CreateFileA
CloseHandle
GetLocalTime
SetEnvironmentVariableA
GetCurrentProcessId
GetCommandLineA
GetCPInfo
GetOEMCP
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteFile
OutputDebugStringW
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
GetModuleHandleExW
DeleteFiber
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FreeLibrary
LoadLibraryA
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
RaiseException
GetModuleFileNameW
WriteConsoleW
ExitProcess
SetConsoleCtrlHandler
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapFree
GetACP
CompareStringW
LCMapStringW
GetStringTypeW
WaitForSingleObjectEx
CreateThread
HeapReAlloc
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindFirstFileExA
FindNextFileA
IsValidCodePage
ReadFile

ws2_32

closesocket
WSASetLastError
send
WSAGetLastError
WSACleanup
recv

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

shlwapi

PathAppendA
PathRemoveFileSpecA

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

advapi32

RegisterEventSourceW
DeregisterEventSource
CryptSetHashParam
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey

Exports

Exports

_getData@8
_getlist2@8
a1
akt
b15ykuj
b5yku3
bbcc
c3b
dg
dz
ecmb7
eebb5
eeff
em5l
enb4u
enk4e9
fac
fce
fd1
fenk4
fenk4g9
ffmm5
fomaq
fst
gek49
getDescription
getErrorMessage
getResult
getVersion
getWarnMsg
getWarnTime
getlist
ggkk5
grkc8
grkc9
gyam8rx
hasInterference
hhmm
hhmm5
hlichlp
hnym5
hqbjo
hqbju
hqnju
initData
ipbwm
kml
krty9
lkm
llrr
ma3t
mirys
ngeil
pbDispose
qc6b
rrgg
ry81x
rym81x
swfp1
swfpw1s
sz
veek8
vejk8
vlk7
vpctn
vvjj5
wtf8bp
xlislp
yphxn

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cdec25f8dbf4111450aafcc8d4d122e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

crypt32

shlwapi

user32

advapi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 403KB - Virtual size: 402KB

.data Size: 6KB - Virtual size: 19KB

.rsrc Size: 512B - Virtual size: 408B

.reloc Size: 46KB - Virtual size: 46KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 403KB - Virtual size: 402KB

.data
Size: 6KB - Virtual size: 19KB

.rsrc
Size: 512B - Virtual size: 408B

.reloc
Size: 46KB - Virtual size: 46KB