2923dd7b6686ad388b901322ac48a3ea553666330788028252790f338bb1b250

Sharing

Copy URL

Twitter E-mail

General

Target

2923dd7b6686ad388b901322ac48a3ea553666330788028252790f338bb1b250
Size

6.5MB
MD5

164e99d37256a58857463aaad0e4576d
SHA1

0c4645cc0fea2580ee3cc7ca4a2097653aa972ed
SHA256

2923dd7b6686ad388b901322ac48a3ea553666330788028252790f338bb1b250
SHA512

a97f729bdf3136f80cadfa21ed519c5f042d7ed0bb0d5afef1d2f9647e5637bbbba03afb98f2feec56fef844dbedb6ea2878b242385d477d00d31fec6a99ef37
SSDEEP

196608:e2s/Kp9E8hz6syk2g37WVfB1gSiZ+RtxnHVN333VtQx1SI:eBy3Nhz/dp7Whr+Z+ZD3HVtIp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2923dd7b6686ad388b901322ac48a3ea553666330788028252790f338bb1b250

Files

2923dd7b6686ad388b901322ac48a3ea553666330788028252790f338bb1b250
.dll windows:6 windows x64

45fafc7db02938bf30577d4af3b4f696

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetLastError
GetModuleFileNameW
CloseHandle
CreateFileW
ReadFile
GetLocalTime
GetFileSize
GetFileInformationByHandle
FileTimeToSystemTime
CopyFileA
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
SetEndOfFile
WriteConsoleW
UnmapViewOfFile
SetFilePointer
WriteFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
CreateDirectoryA
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
WideCharToMultiByte
GetModuleFileNameA
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetFileAttributesA
WaitForSingleObjectEx
Sleep
SwitchToThread
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
MultiByteToWideChar
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateDirectoryW
LocalAlloc
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
SystemTimeToFileTime
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetModuleHandleExW
ExitProcess
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
MoveFileExW
HeapReAlloc
FindFirstFileExW
FindNextFileW
IsValidCodePage
RtlUnwind
GetVersionExW

user32

wsprintfW
GetDesktopWindow

advapi32

CredDeleteW
RegCreateKeyExA
CredWriteW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExA

shell32

SHGetSpecialFolderPathA
SHCreateDirectoryExA

oleaut32

VariantClear
SysAllocString
SysFreeString

shlwapi

PathFileExistsA
PathFileExistsW

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

libcrypto-1_1-x64

MD5_Final
AES_set_encrypt_key
AES_cbc_encrypt
AES_set_decrypt_key
MD5_Update
MD5_Init
SHA256_Final
SHA256_Update
SHA256_Init

crypt32

CertGetNameStringW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgClose
CertCloseStore
CryptQueryObject

ole32

CoCreateGuid
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize

Exports

Exports

ClearKeytarLegacy
DecryptData
DecryptUserInfo
EncryptData
EncryptUserInfo
RemoveData
RemoveExtra
RemoveUserInfo
SetDebugMode
SetLogPath
SetStoragePath

Sections

.text
Size: 488KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lr30
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lr31
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 721B - Virtual size: 721B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

45fafc7db02938bf30577d4af3b4f696

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

iphlpapi

libcrypto-1_1-x64

crypt32

ole32

Exports

Exports

Sections

.text Size: 488KB - Virtual size: 488KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 28KB - Virtual size: 28KB

.pdata Size: 28KB - Virtual size: 28KB

_RDATA Size: 4KB - Virtual size: 4KB

.lr30 Size: 1.9MB - Virtual size: 1.9MB

.lr31 Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 721B - Virtual size: 721B

.l1 Size: 9KB - Virtual size: 9KB

.text
Size: 488KB - Virtual size: 488KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 28KB - Virtual size: 28KB

.pdata
Size: 28KB - Virtual size: 28KB

_RDATA
Size: 4KB - Virtual size: 4KB

.lr30
Size: 1.9MB - Virtual size: 1.9MB

.lr31
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 721B - Virtual size: 721B

.l1
Size: 9KB - Virtual size: 9KB