4c34aee4686d379069bacd7d246384b7cfd37b1db1f286debb4f9b660d8aca15

Sharing

Copy URL Twitter E-mail

General

Target

4c34aee4686d379069bacd7d246384b7cfd37b1db1f286debb4f9b660d8aca15
Size

14.8MB
MD5

87782393989f3c3ffaf8b1b9ec6699bd
SHA1

d6f7f48a556935dd9fa9aebf4a38bb9d20ae759f
SHA256

4c34aee4686d379069bacd7d246384b7cfd37b1db1f286debb4f9b660d8aca15
SHA512

e6a99607339ed1f9cd7fa4024c35069fab00f55f815feedc29c1cb184e9dc2dff5072305303cb17b0c502c8b34bf5e87dd19dbd42dccdcc77d7952a3f1c956aa
SSDEEP

196608:m4duF7XLhtZKdwvavz3qSzfbhnKGDoNfKagSUJDzwVPab/sSzIlt3q3EhH6YP:SFhXovJ9KGKI1EVmRIlRqGH6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c34aee4686d379069bacd7d246384b7cfd37b1db1f286debb4f9b660d8aca15

Files

4c34aee4686d379069bacd7d246384b7cfd37b1db1f286debb4f9b660d8aca15
.dll windows:6 windows x64

a33ba2e5aa1e306d99d57ca732c92fb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

NtQueryInformationThread
RtlCompareUnicodeString
RtlPcToFileHeader
NtGetContextThread
RtlLeaveCriticalSection
ZwLoadDriver
RtlCaptureContext
ZwUnloadDriver
RtlEnterCriticalSection
NtDeviceIoControlFile
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlImageDirectoryEntryToData
NtUnmapViewOfSection
NtMapViewOfSection
NtClose
NtCreateSection
RtlFreeUnicodeString
NtCreateFile
RtlDosPathNameToNtPathName_U_WithStatus
LdrAccessResource
LdrFindResource_U
RtlImageNtHeader
RtlGetVersion

fltlib

FilterConnectCommunicationPort
FilterReplyMessage
FilterGetMessage

shlwapi

PathIsRelativeW
PathAppendW
PathSkipRootW
SHDeleteKeyW

setupapi

SetupOpenFileQueue
CM_Locate_DevNodeA
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupCloseFileQueue
SetupDiDestroyDriverInfoList
CM_Reenumerate_DevNode
SetupDiCallClassInstaller
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupScanFileQueueW
SetupDiSetSelectedDriverW
SetupDiGetDriverInfoDetailW
SetupDiGetDevicePropertyW
SetupDiDestroyDeviceInfoList
CM_Get_Device_ID_ExW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInfoListDetailW
SetupDiGetClassDevsExW

kernel32

LCMapStringW
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RaiseException
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetCPInfo
CreateThread
CloseHandle
GetTickCount64
GetTickCount
Sleep
GetLastError
GetCurrentProcessId
WaitForSingleObject
ResumeThread
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
ResetEvent
CreateFileA
IsValidLocale
ReadFile
SetEvent
GetCurrentProcess
LoadLibraryExW
GetFileSizeEx
LoadLibraryW
VirtualAllocEx
VirtualFreeEx
CreateFileW
GetCurrentThreadId
GetCurrentThread
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesA
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetLogicalDriveStringsW
QueryDosDeviceW
lstrlenW
lstrcpyW
lstrcatW
LoadLibraryExA
GetProcessId
Wow64GetThreadContext
Wow64SuspendThread
SuspendThread
FindClose
FindNextFileW
SetLastError
WriteConsoleW
GetStdHandle
HeapFree
HeapAlloc
GetModuleHandleExW
ExitProcess
GetLocaleInfoW
GetUserDefaultLCID
GetFileSize
EnumSystemLocalesW
HeapSize
SetFilePointerEx
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
CreateEventA
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
GetConsoleOutputCP
WriteFile
GetConsoleMode
GetFileType
FreeLibrary
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
TlsFree

user32

FindWindowA
wsprintfW
GetWindowThreadProcessId

advapi32

RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCreateKeyW
RegOpenKeyW
RegQueryValueExW
RegCloseKey

shell32

SHQueryUserNotificationState

ole32

CoInitializeEx
CoSetProxyBlanket

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

Exports

Exports

InitClient

Sections

.text
Size: 744KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.$/g
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.(io
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wYt
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 729B - Virtual size: 729B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a33ba2e5aa1e306d99d57ca732c92fb5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

fltlib

shlwapi

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 744KB - Virtual size: 744KB

.rdata Size: 532KB - Virtual size: 532KB

.data Size: 28KB - Virtual size: 28KB

.pdata Size: 48KB - Virtual size: 48KB

_RDATA Size: 4KB - Virtual size: 4KB

.$/g Size: 4.9MB - Virtual size: 4.9MB

.(io Size: 4KB - Virtual size: 4KB

.wYt Size: 8.5MB - Virtual size: 8.5MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 729B - Virtual size: 729B

.l1 Size: 10KB - Virtual size: 10KB

.text
Size: 744KB - Virtual size: 744KB

.rdata
Size: 532KB - Virtual size: 532KB

.data
Size: 28KB - Virtual size: 28KB

.pdata
Size: 48KB - Virtual size: 48KB

_RDATA
Size: 4KB - Virtual size: 4KB

.$/g
Size: 4.9MB - Virtual size: 4.9MB

.(io
Size: 4KB - Virtual size: 4KB

.wYt
Size: 8.5MB - Virtual size: 8.5MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 729B - Virtual size: 729B

.l1
Size: 10KB - Virtual size: 10KB