afc0e94b2dd69a2ba3cd57ea76159b35055c0d5e2e3ab24ee78a20bc96c2c10b

Sharing

Copy URL Twitter E-mail

General

Target

afc0e94b2dd69a2ba3cd57ea76159b35055c0d5e2e3ab24ee78a20bc96c2c10b
Size

806KB
MD5

088f262a7f46ab97292fb0e1b0f3b97f
SHA1

6e5a668d83aff5be5936a1adf8da322550f2a70f
SHA256

afc0e94b2dd69a2ba3cd57ea76159b35055c0d5e2e3ab24ee78a20bc96c2c10b
SHA512

a2da76172fb5500432fed1d5819c6af0d2f2c868b4f12aa86ef3093ab5657dbc7062b6e5373e8dc0cf4eb99d5cf1148ba2e50f3f63ead82c4ba015636bc4a223
SSDEEP

24576:6PdRpzOFESghLNyuz1/66NAQG08MZD7hvll52:KLOanhpz1D7r997Tl52

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afc0e94b2dd69a2ba3cd57ea76159b35055c0d5e2e3ab24ee78a20bc96c2c10b

Files

afc0e94b2dd69a2ba3cd57ea76159b35055c0d5e2e3ab24ee78a20bc96c2c10b
.dll windows:6 windows x86

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

LoadStringW
SendMessageW
IsWindow
GetSystemMetrics
MessageBoxW
EnumChildWindows
FindWindowA
FindWindowExA
GetClassNameA
GetWindowThreadProcessId
GetWindowTextA
GetDesktopWindow
FindWindowW
IsCharAlphaA
LoadStringA

msi

ord31
ord70
ord8
ord160
ord50
ord116
ord125
ord118
ord145
ord171
ord159
ord47
ord49
ord74
ord147
ord103
ord17
ord121

shell32

Shell_NotifyIconW

setupapi

InstallHinfSectionW

kernel32

GetFileAttributesExW
SetEndOfFile
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
QueryPerformanceFrequency
VerifyVersionInfoW
GetProductInfo
GetNativeSystemInfo
VerSetConditionMask
GetTickCount
GetLocalTime
GetSystemTime
LoadLibraryExA
VirtualQuery
VirtualProtect
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetDriveTypeA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetModuleHandleA
GetModuleHandleW
GetProcAddress
SizeofResource
FindResourceW
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryW
CreateFileA
GetFileInformationByHandle
ReadFile
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetSystemInfo
GetVersionExA
FreeLibrary
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
RemoveDirectoryW
Sleep
GetCurrentThread
MoveFileExW
FileTimeToLocalFileTime
SetLastError
GetSystemTimeAsFileTime
FormatMessageW
FlushFileBuffers
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
SetEnvironmentVariableW
GetDriveTypeW
GetVolumeInformationW
GetTempPathW
GetSystemDirectoryW
SetCurrentDirectoryW
GetDiskFreeSpaceExW
HeapReAlloc
GetFullPathNameW
SetFileAttributesW
OutputDebugStringA
GetModuleFileNameW
WriteConsoleW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleHandleExW
GetACP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleOutputCP
GetConsoleMode
GetFileType
SetStdHandle
PeekNamedPipe
GetTimeZoneInformation
ExitProcess

Exports

Exports

VMAppSearch
VMAppTerminate
VMAutoSelectInstallDrive
VMCleanupTrayIcons
VMDecoupleChildInstaller
VMDeleteFilesAndFolders
VMDetectRunningVM
VMDetectWin2003R2
VMDisplayWarnings
VMEnterPlayerLicense
VMEnterWorkstationLicense
VMInstallInfKernelDriver
VMInstallKernelDriver
VMIsRepairSafe
VMMessageBox
VMNeedValidLicense
VMReadInProperties
VMRegSvr
VMRemoveRegistryValues64
VMResetRegSecurity
VMServiceFailureConfig
VMSetRealVersionNT
VMSetVMSysVer
VMStopRunningServices
VMUninstallInfKernelDriver
VMUninstallKernelDriver
VMUnregSvr
VMValidateINSTALLDIR
VMValidatePlayerLicense
VMValidateSerialNumber
VMValidateWorkstationLicense
VMWriteRegistryValues64

Sections

.text
Size: 513KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

410ee1a1a965884e2b241bf8e2e3791b

Headers

DLL Characteristics

File Characteristics

Imports

user32

msi

shell32

setupapi

kernel32

Exports

Exports

Sections

.text Size: 513KB - Virtual size: 513KB

.rdata Size: 176KB - Virtual size: 176KB

.data Size: 51KB - Virtual size: 61KB

.didat Size: 512B - Virtual size: 204B

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 513KB - Virtual size: 513KB

.rdata
Size: 176KB - Virtual size: 176KB

.data
Size: 51KB - Virtual size: 61KB

.didat
Size: 512B - Virtual size: 204B

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 25KB - Virtual size: 24KB