16def26b61bedf607e7ae97481369abf9f3291aa343bca43aceab8783a681579

Sharing

Copy URL Twitter E-mail

General

Target

16def26b61bedf607e7ae97481369abf9f3291aa343bca43aceab8783a681579
Size

179KB
MD5

23b2608e1034d5ee0070b97fc29d3fb6
SHA1

fbb32aff73aa87898cc650a9db52f8411eecf4a4
SHA256

16def26b61bedf607e7ae97481369abf9f3291aa343bca43aceab8783a681579
SHA512

4cc3b17dcbece9fd98a604bacd479e989e92512decef2d9b5a5028ff68bf97ef147b3aaf968da2a096fcc20c83502a245e3bccebb7f97c917fb6479b55fd542e
SSDEEP

3072:R5H0Fo/3Vgr4TYFJOK6wQAMqENU3dwZqi/vO5V8p5BIaX:Ao/3PTY0wDEaSZw5oHI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16def26b61bedf607e7ae97481369abf9f3291aa343bca43aceab8783a681579

Files

16def26b61bedf607e7ae97481369abf9f3291aa343bca43aceab8783a681579
.dll windows:6 windows x64

558f23de1b89d77ba9e35ee2932cc8fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

hid

HidD_GetSerialNumberString
HidD_GetHidGuid
HidD_GetFeature
HidP_GetValueCaps
HidD_SetFeature
HidD_FreePreparsedData
HidD_GetPreparsedData
HidP_GetCaps
HidD_GetAttributes

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

kernel32

WriteConsoleW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
ReadFile
CancelIo
EnterCriticalSection
WaitForMultipleObjects
SetThreadPriority
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateFileW
GetModuleHandleA
CreateEventW
Sleep
GetLastError
CreateFileA
SetEvent
QueryPerformanceFrequency
CloseHandle
CreateThread
GetOverlappedResult
DeleteCriticalSection
GetModuleHandleW
QueryPerformanceCounter
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetProcessHeap
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

DefWindowProcA
GetWindowLongPtrA
GetWindowLongPtrW
DefWindowProcW

Exports

Exports

Ot2020CheckInterface
Ot2020CloseDevice
Ot2020CreateImageProcessorParameterToSwap
Ot2020CreateReceiving
Ot2020DataPartitionErase
Ot2020DataPartitionRead
Ot2020DataPartitionWrite
Ot2020DeleteReceiving
Ot2020EnumerateDevicesA
Ot2020EnumerateDevicesW
Ot2020ExchangeImageResult
Ot2020ExchangeTest
Ot2020GetAllDataPartitionId
Ot2020GetComponentCount
Ot2020GetComponentUuid
Ot2020GetDataPartitionDuration
Ot2020GetDataPartitionIdImageCalibrating
Ot2020GetDataPartitionIdImageProcessorParameter
Ot2020GetDataPartitionIdSoundWaveProcessorParameter
Ot2020GetDataPartitionIdTouchScreenLayout
Ot2020GetDataPartitionInformation
Ot2020GetDeviceTag
Ot2020GetDiagnosis
Ot2020GetExposure
Ot2020GetFirmwareVersion
Ot2020GetImageData
Ot2020GetImageInformation
Ot2020GetImageProcessorParameterSize
Ot2020GetLightSource
Ot2020GetPathInformation
Ot2020GetPollingComponents
Ot2020GetPollingComponentsStatus
Ot2020GetPollingDataInformation
Ot2020GetSerialNumber
Ot2020GetSoundWaveInformation
Ot2020GetSwapCapacity
Ot2020GetTest
Ot2020GetVersion
Ot2020GetVerticalOffset
Ot2020OpenDeviceA
Ot2020OpenDeviceW
Ot2020SetCameraWorkingMode
Ot2020SetDeviceReset
Ot2020SetDiagnosis
Ot2020SetExposure
Ot2020SetLightSource
Ot2020SetPollingComponentsStatus
Ot2020SetPollingDataNotReport
Ot2020SetPollingDataReport
Ot2020SetSerialNumber
Ot2020SetTest
Ot2020SetVerticalOffset
Ot2020SwapLoad
Ot2020SwapRead
Ot2020SwapSave
Ot2020SwapWrite
Ot2020TriggerAll

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

558f23de1b89d77ba9e35ee2932cc8fc

Headers

DLL Characteristics

File Characteristics

Imports

hid

setupapi

kernel32

user32

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB