616733604a2b7c6a7febdf67a30d24f5f7ddee9b8d51c4d5eeb1695f4d4f2a13

Sharing

Copy URL

Twitter E-mail

General

Target

616733604a2b7c6a7febdf67a30d24f5f7ddee9b8d51c4d5eeb1695f4d4f2a13
Size

4.5MB
MD5

ebde928ea83997c3a3021cd0e1b7c18c
SHA1

3536a8dd742ba9944883ae575b54ae1621941dd0
SHA256

616733604a2b7c6a7febdf67a30d24f5f7ddee9b8d51c4d5eeb1695f4d4f2a13
SHA512

22de896ec3c384d8fa0c12387592f82202ac251b2f15567f7dca2852c7a83ced743c4520ae8650221c5a5d1dba4e05c4687a6edf34d5ae428882040ca18b7ae5
SSDEEP

98304:rnNgCz9flKGBggxhfDrRd1As+UGg2IzFYAwZFM4FdJv8tSMZZoujzI:rNgCzrDPjzfDgDAeFdJsSMlc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
616733604a2b7c6a7febdf67a30d24f5f7ddee9b8d51c4d5eeb1695f4d4f2a13

Files

616733604a2b7c6a7febdf67a30d24f5f7ddee9b8d51c4d5eeb1695f4d4f2a13
.dll regsvr32 windows:6 windows x86

7269c01b5e44275da2b3792124b25bc9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemPowerStatus
CompareFileTime
CreateDirectoryW
CreateFileW
DeleteFileW
FileTimeToLocalFileTime
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
LocalFileTimeToFileTime
RemoveDirectoryA
SetFileAttributesW
SetFileTime
GetPrivateProfileStringW
WritePrivateProfileStringW
CopyFileW
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
WideCharToMultiByte
GetCurrentThreadId
GetCurrentProcess
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
VirtualFreeEx
SetProcessWorkingSetSize
K32EmptyWorkingSet
FindFirstFileA
FindNextFileA
GetCommandLineW
GetCurrentProcessId
TerminateProcess
OpenThread
TerminateThread
OpenProcess
ReadProcessMemory
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
Module32FirstW
Module32NextW
K32GetProcessMemoryInfo
K32GetPerformanceInfo
GetModuleFileNameA
GetProcessTimes
CreateThread
CreateFileA
GetFileSizeEx
ReadFile
DeviceIoControl
InitializeCriticalSectionAndSpinCount
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateEventW
OpenEventW
WriteProcessMemory
CreateFileMappingW
OpenFileMappingW
GlobalUnlock
UnmapViewOfFile
MulDiv
CreateThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CloseThreadpool
QueryFullProcessImageNameA
RemoveDirectoryW
WriteFile
ExitProcess
GetSystemInfo
GetSystemTimeAsFileTime
GetNativeSystemInfo
IsWow64Process
GlobalFree
K32GetProcessImageFileNameW
GlobalAlloc
LockResource
FindResourceExW
SetEndOfFile
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetExitCodeProcess
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
LocalFree
OutputDebugStringW
IsDebuggerPresent
VerifyVersionInfoW
SetThreadExecutionState
WinExec
DeleteTimerQueueTimer
TrySubmitThreadpoolCallback
GetPhysicallyInstalledSystemMemory
GlobalLock
GetWindowsDirectoryW
GetSystemDirectoryW
SetLocalTime
GetLocalTime
GlobalMemoryStatusEx
GetSystemTimes
CreateProcessW
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
CloseHandle
Beep
GetTempPathW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
VerSetConditionMask
SetThreadLocale
GetThreadLocale
MultiByteToWideChar
lstrcmpiW
FindResourceW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
MapViewOfFile
EncodePointer
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

TranslateMessage
DispatchMessageW
UnregisterClassW
CharNextW
ExitWindowsEx
SendMessageW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
wsprintfW
GetClassLongW
MessageBoxW
MessageBoxA
RedrawWindow
InvalidateRect
GetWindowDC
UpdateWindow
DrawIcon
MapVirtualKeyW
SendInput
LoadImageW
DefWindowProcW
EmptyClipboard
KillTimer
GetSystemMetrics
DrawTextW
GetDC
ReleaseDC
GetDesktopWindow
ChangeDisplaySettingsW
EnumDisplaySettingsW
SystemParametersInfoW
MonitorFromWindow
PostQuitMessage
RegisterClassExW
GetMessageW
GetMonitorInfoW
GetWindowThreadProcessId
SendMessageTimeoutW
PostMessageW
AttachThreadInput
GetDoubleClickTime
SetDoubleClickTime
GetFocus
GetKeyState
GetForegroundWindow
GetCursorPos
GetIconInfo
BlockInput
GetCursorInfo
GetAncestor
IsWindow
IsHungAppWindow
ShowWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
IsWindowVisible
IsIconic
IsZoomed
SetFocus
EnableWindow
IsWindowEnabled
SetForegroundWindow
SetWindowTextW
GetWindowTextA
GetClientRect
GetWindowRect
ClientToScreen
ScreenToClient
WindowFromPoint
FillRect
LoadCursorW
GetWindowLongW
GetWindow
GetClassNameA
SetWindowLongW
CreateWindowExW
SetTimer
EnumWindows
EnumChildWindows
BeginPaint
EndPaint
SetWindowRgn
GetWindowTextW
GetClassNameW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
DeleteDC
CreateSolidBrush
DeleteObject
GetDeviceCaps
GetTextExtentPoint32W
RoundRect
CreatePen
GetObjectW
LineTo
SetBkColor
GetObjectA
MoveToEx
GetDIBits
CreateEllipticRgn
CreateRoundRectRgn
GetStockObject
RealizePalette
SelectPalette
SelectObject
SetBkMode
SetTextColor
GetPixel
SetDIBColorTable
CreateDIBSection

advapi32

RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
InitiateSystemShutdownExW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW

shell32

SHCreateDirectoryExW
SHGetPathFromIDListEx
SHFileOperationA
Shell_NotifyIconW
SHBrowseForFolderW
ShellExecuteW
SHGetKnownFolderPath

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
SysAllocString
VariantInit
VariantClear
VariantChangeType
LoadRegTypeLi
SysFreeString
SysAllocStringLen

ws2_32

getaddrinfo
freeaddrinfo
htons
connect
WSACleanup
WSAStartup
closesocket
recv
socket
ntohl

shlwapi

PathFileExistsW
PathFindExtensionW

urlmon

URLDownloadToFileW

winmm

timeGetTime

gdiplus

GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFileICM
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipSaveAddImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipSetPropertyItem
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipLoadImageFromFile
GdipGetImageEncoders
GdipDrawImageRectI

msimg32

TransparentBlt

dwmapi

ord102
DwmEnableBlurBehindWindow

imm32

ImmDisableIME

powrprof

PowerGetActiveScheme
PowerWriteDCValueIndex
PowerWriteACValueIndex
PowerReadDCValue
PowerReadACValue
SetSuspendState
PowerSetActiveScheme

bcrypt

BCryptEncrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptGetProperty
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptOpenAlgorithmProvider

dxgi

CreateDXGIFactory

iphlpapi

GetAdaptersAddresses

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx0
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.upx1
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7269c01b5e44275da2b3792124b25bc9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

urlmon

winmm

gdiplus

msimg32

dwmapi

imm32

powrprof

bcrypt

dxgi

iphlpapi

wininet

Exports

Exports

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 164KB

.data Size: - Virtual size: 19KB

.upx0 Size: - Virtual size: 2.2MB

.upx1 Size: 4.5MB - Virtual size: 4.5MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 40KB - Virtual size: 263KB

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 164KB

.data
Size: - Virtual size: 19KB

.upx0
Size: - Virtual size: 2.2MB

.upx1
Size: 4.5MB - Virtual size: 4.5MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 40KB - Virtual size: 263KB