9ce419b94982b042f0cfabd3613bfaea978ee61adcfea4419774dd9a44c22402

Sharing

Copy URL Twitter E-mail

General

Target

9ce419b94982b042f0cfabd3613bfaea978ee61adcfea4419774dd9a44c22402
Size

3.4MB
MD5

f711345527f7a0cd0264ca7970899ae9
SHA1

f5ad0f59ab4e3bec885a9080ab7f8f38d39f6db1
SHA256

9ce419b94982b042f0cfabd3613bfaea978ee61adcfea4419774dd9a44c22402
SHA512

b049988806b0a828fc5fdbe59dcbd6a146fd2ac2a6d34a1c598b480c3e7cd714bbb9f6539f759e7839b062bffd2fdbb7ce8cb0318b0bdf39d1191e4cf5302c72
SSDEEP

49152:7WjudlyCOLZSPY8Mh6HhwB04WuqiNrsDqWqZR/3HGey+B/BABFTwW5V83:vEFSPTUHzyCjT3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ce419b94982b042f0cfabd3613bfaea978ee61adcfea4419774dd9a44c22402

Files

9ce419b94982b042f0cfabd3613bfaea978ee61adcfea4419774dd9a44c22402
.dll windows:5 windows x64

3bb67a6d6434fca8979a4968d0943e24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

imm32

ImmGenerateMessage
ImmReSizeIMCC
ImmUnlockIMCC
ImmLockIMCC
ImmCreateIMCC
ImmUnlockIMC
ImmLockIMC

shlwapi

PathFileExistsW
PathFileExistsA

kernel32

GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
LockResource
LoadResource
SizeofResource
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsGetValue
TlsSetValue
FindResourceW
GetFileAttributesW
MulDiv
lstrcpyW
LCMapStringW
RtlCaptureContext
GetCurrentThread
GetThreadContext
SuspendThread
ResumeThread
GetModuleFileNameA
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
TerminateProcess
ReadProcessMemory
GetPrivateProfileStringA
SetEndOfFile
SetFilePointerEx
CreateFileA
DeleteFileA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
FormatMessageA
LoadLibraryA
GetTempPathA
GetFileAttributesA
UnlockFile
LockFileEx
LockFile
SetFilePointer
AreFileApisANSI
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
MoveFileExW
FlushFileBuffers
GetCurrentDirectoryW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
PeekNamedPipe
GetDriveTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetFileType
GetFullPathNameA
GetFullPathNameW
GetModuleHandleExW
RtlUnwindEx
RtlPcToFileHeader
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
ExitProcess
FindResourceExW
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsAlloc
CreateEventW
SetLastError
EncodePointer
TryEnterCriticalSection
FindFirstFileExA
CopyFileW
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
GetModuleHandleW
GetCurrentProcessId
CloseHandle
LoadLibraryW
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateThread
TerminateThread
Sleep
GetLocalTime
FindNextFileW
FindFirstFileW
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
GetWindowsDirectoryW
GetTempPathW
CreateProcessW
lstrcmpiW
GetTickCount
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
FindClose
ReadFile
GetFileSize
WaitForSingleObject
GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
GetSystemTime

user32

SetMenuInfo
GetKeyState
FindWindowW
PostMessageW
GetWindowThreadProcessId
SetWindowPos
TrackPopupMenu
IsWindow
IsWindowVisible
BringWindowToTop
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
CharLowerW
GetFocus
keybd_event
GetSystemMetrics
GetForegroundWindow
GetWindowTextW
GetWindowRect
GetDesktopWindow
GetParent
FindWindowExW
GetClassNameW
SetTimer
KillTimer
SetRect
SendMessageW
DestroyWindow
RegisterWindowMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
LoadCursorW
GetDC
ReleaseDC
PtInRect
SystemParametersInfoW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayMonitors
ClientToScreen
WindowFromPoint
LoadStringW
SendMessageTimeoutW
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
SetWindowTextW
SetCursor
GetWindowLongPtrW
SetWindowLongPtrW
ShowWindow
IsIconic
InvalidateRect
CallWindowProcW
MoveWindow
GetDlgItemTextW
SetFocus
MessageBoxW
SetDlgItemInt
GetDlgItemInt
GetAsyncKeyState
ReleaseCapture
MessageBeep
ToAscii
SetCapture
OffsetRect
UpdateLayeredWindow
BeginPaint
EndPaint
ScreenToClient
CharNextW
DrawTextW
GetCapture
GetCaretPos
GetGUIThreadInfo
SetRectEmpty
UnionRect
GetClientRect
FillRect
GetCursorPos
CreateMenu
CreatePopupMenu
DestroyMenu
DeleteMenu
RemoveMenu
ModifyMenuW
InsertMenuW
EnableMenuItem

gdi32

DeleteDC
BitBlt
CreateDIBSection
SetTextColor
SetBkMode
GetDeviceCaps
MoveToEx
LineTo
CreatePen
TextOutW
GetTextExtentPoint32W
GetTextExtentPointW
ExcludeClipRect
CreateSolidBrush
CreateFontW
EnumFontsW
CreateICW
GetPixel
SelectObject
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject

advapi32

GetSecurityDescriptorDacl
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
LookupAccountNameW
ImpersonateLoggedOnUser
RevertToSelf
SetSecurityInfo
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
RegCreateKeyExW
DuplicateTokenEx
LookupAccountSidW
GetSecurityDescriptorSacl
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EqualSid

shell32

ShellExecuteW
SHAppBarMessage
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal

gdiplus

GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipDrawImageRectI
GdipCloneFont
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipFillRectangleI
GdipGetGenericFontFamilySansSerif
GdipCloneBitmapAreaI
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFillPath
GdipDrawPath
GdipDrawLineI
GdipSetImageAttributesColorKeys
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipSetPenDashStyle
GdipAddPathArcI
GdipAddPathLineI
GdipDeleteFont
GdipCreateFont
GdipCreateFontFamilyFromName
GdipDrawString
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipGetImageRawFormat
GdipGetImageWidth
GdipDrawLine
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAlloc
GdipDisposeImageAttributes
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipPrivateAddFontFile
GdipGetFontCollectionFamilyCount
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipFree
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipGetFontSize
GdipGetFamily
GdipDeleteFontFamily
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipGetImageHeight

psapi

GetModuleFileNameExW

dbghelp

StackWalk64
EnumerateLoadedModules64
SymFunctionTableAccess64
SymGetModuleBase64
SymInitialize

Exports

Exports

CandWndProc
CompWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 803KB - Virtual size: 803KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3bb67a6d6434fca8979a4968d0943e24

Headers

DLL Characteristics

File Characteristics

Imports

imm32

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

psapi

dbghelp

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 737KB - Virtual size: 736KB

.data Size: 59KB - Virtual size: 95KB

.pdata Size: 135KB - Virtual size: 134KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 803KB - Virtual size: 803KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 737KB - Virtual size: 736KB

.data
Size: 59KB - Virtual size: 95KB

.pdata
Size: 135KB - Virtual size: 134KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 803KB - Virtual size: 803KB

.reloc
Size: 10KB - Virtual size: 9KB