f5ed610a17d93441cb692ef240482dc30945ace07af8c6bcf663764f2a01307d

Sharing

Copy URL

Twitter E-mail

General

Target

f5ed610a17d93441cb692ef240482dc30945ace07af8c6bcf663764f2a01307d
Size

13.6MB
MD5

527c6f59ff4a0a4d98767c830a1d80d0
SHA1

ca8f28fa59bd7fa4a48baf3268b9d1adeb833774
SHA256

f5ed610a17d93441cb692ef240482dc30945ace07af8c6bcf663764f2a01307d
SHA512

8f074d0707c34b3eef340c81f84b5a7f42bbb036622d99e4fd255f4e52f9ac3fabb925c8fcf459c286bdf65b7820866f4ae86c074f2c100cbce06b0fc239f75f
SSDEEP

196608:0q0nv96H0NBWoKi656utDEFOhLJe/D3HO:05nv96HdoKi6kuKchLJwD3O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5ed610a17d93441cb692ef240482dc30945ace07af8c6bcf663764f2a01307d

Files

f5ed610a17d93441cb692ef240482dc30945ace07af8c6bcf663764f2a01307d
.dll windows:6 windows x64

10e06c2154fdda98c39ce2f9d2f8d24d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ReleaseMutex
WaitForSingleObject
GetProcAddress
DecodePointer
WaitNamedPipeW
GetSystemTimeAsFileTime
CreateFileW
WriteFile
SetNamedPipeHandleState
ReadFile
GetACP
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
GlobalUnlock
TlsGetValue
DeleteCriticalSection
InitializeCriticalSectionEx
SetThreadPriority
GetCurrentThread
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
GetTickCount64
SetFileAttributesW
OutputDebugStringW
OpenWaitableTimerW
CreateFileMappingW
CreateWaitableTimerW
GetLocalTime
SwitchToThread
GetModuleHandleA
FindClose
OpenMutexW
CreateEventW
SetEvent
OpenThread
ReleaseSemaphore
GlobalLock
GlobalFree
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
EnterCriticalSection
TlsSetValue
GetModuleFileNameA
GlobalAddAtomW
GlobalGetAtomNameW
OpenEventW
DebugBreak
GetTickCount
ResumeThread
VirtualFreeEx
GetModuleHandleW
GetCurrentProcessId
ReadProcessMemory
VirtualAllocEx
CloseHandle
OpenProcess
GetCurrentThreadId
CreateSemaphoreW
LoadLibraryW
FreeLibrary
DeleteFileW
GetCurrentProcess
DuplicateHandle
CreateThread
SetWaitableTimer
VirtualQuery
GetSystemWow64DirectoryW
SetLastError
GetCurrentDirectoryW
GetSystemInfo
LocalFree
LocalAlloc
CreateMutexW
GetStartupInfoW
MoveFileExW
CopyFileW
GetSystemTime
SetFilePointer
GetTempFileNameW
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
GlobalHandle
LoadLibraryA
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapSize
SetConsoleCtrlHandler
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetTempPathW
GetLastError
Sleep
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileW
RaiseException
VirtualProtect
LoadLibraryExA
ExitThread
FormatMessageW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryDosDeviceW
RemoveDirectoryW
GetLogicalDriveStringsW
FileTimeToSystemTime
CreateDirectoryW
GetProcessId
GetFileAttributesExW
CreateProcessW
GetFileTime
GetExitCodeProcess
lstrlenW
TlsAlloc
TlsFree
SizeofResource
LockResource
LoadResource
FindResourceW
HeapFree
GetFullPathNameW
lstrlenA
HeapAlloc
GetProcessHeap
LoadLibraryExW
GetVersionExW
GetWindowsDirectoryW
TerminateProcess
IsProcessorFeaturePresent
PeekNamedPipe
ExpandEnvironmentStringsW
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
OutputDebugStringA
MulDiv
ReleaseSRWLockExclusive
FindFirstFileExW
IsDebuggerPresent
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetNativeSystemInfo
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
ResetEvent
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
lstrcatW
lstrcpyW
GetEnvironmentVariableW
GlobalReAlloc
GetWindowsDirectoryA
CreateFileA
CreateFileMappingA
OpenFileMappingA
InitOnceComplete
InitOnceBeginInitialize
InitializeSRWLock
GetExitCodeThread
GetStringTypeW
EncodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
UnhandledExceptionFilter
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
SetEnvironmentVariableW
GetFileType
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleFileNameW

user32

FindWindowW
IsWindow
NotifyWinEvent
SendMessageW
GetGUIThreadInfo
SetRectEmpty
ReleaseDC
IsIconic
SetClipboardData
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
MonitorFromWindow
SetWindowPos
GetDC
MonitorFromPoint
CharNextW
LoadStringW
WindowFromPoint
wsprintfW
MsgWaitForMultipleObjectsEx
SetPropW
ReplyMessage
LoadCursorW
RegisterClassW
GetClassInfoW
RemovePropW
CreateWindowExW
DefWindowProcW
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
AppendMenuW
GetClientRect
SetCursor
SetCapture
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
TrackPopupMenu
GetWindowPlacement
RegisterClassExW
CreatePopupMenu
ScreenToClient
SetRect
CallWindowProcW
DrawTextW
UpdateLayeredWindow
IntersectRect
SubtractRect
SetCaretPos
wvsprintfW
FillRect
OffsetRect
DestroyIcon
GetKeyboardLayoutList
GetProcessWindowStation
GetUserObjectInformationW
RedrawWindow
GetCursor
SetWindowRgn
SetCursorPos
InflateRect
CopyRect
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
SetScrollInfo
EqualRect
IsRectEmpty
DrawIconEx
PostQuitMessage
GetWindowRect
GetWindow
GetWindowTextLengthW
GetWindowThreadProcessId
GetWindowLongW
GetDesktopWindow
GetTopWindow
IsWindowVisible
GetKeyState
SendInput
SetWindowsHookExW
SetWinEventHook
GetParent
RegisterWindowMessageW
UnhookWinEvent
GetAncestor
GetWindowTextW
mouse_event
GetClassLongPtrW
SetClassLongPtrW
GetClassNameW
GetMenuItemID
InsertMenuItemW
UnhookWindowsHookEx
LoadImageW
SystemParametersInfoW
EndDialog
LoadIconW
SetForegroundWindow
FindWindowExW
GetCaretPos
GetPropW
ClientToScreen
PtInRect
SendMessageTimeoutW
EnumWindows
DispatchMessageW
TranslateMessage
DestroyMenu
GetCursorPos
UnregisterClassW
GetMessageW
SetTimer
PeekMessageW
PostThreadMessageW
MessageBoxW
GetKeyboardState
GetWindowLongPtrW
SetWindowLongPtrW
UnregisterHotKey
RegisterHotKey
KillTimer
DestroyWindow
InvalidateRect
ShowWindow
MoveWindow
GetMessageExtraInfo
PostMessageW
GetFocus
keybd_event
CallNextHookEx
GetSystemMetrics
GetAsyncKeyState
GetForegroundWindow

gdi32

GetDeviceCaps
StretchBlt
BitBlt
CreateDCW
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateFontIndirectW
GetFontData
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
MoveToEx
LineTo
GetStockObject
SelectClipRgn
CreatePen
CreateRectRgn
GetClipRgn
SelectObject
CreateDIBSection
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
DeleteObject
SetBkColor
GetTextExtentExPointW
GetFontUnicodeRanges
CreateCompatibleBitmap
Rectangle
CombineRgn
OffsetRgn
ExtCreateRegion
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchDIBits
SetMapMode
CreateFontW

advapi32

CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetLengthSid
AddAccessAllowedAceEx
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
LookupAccountSidW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
RegisterEventSourceW
RegQueryValueW
DeregisterEventSource
CryptEnumProvidersW

imm32

ImmLockIMC
ImmUnlockIMC
ImmAssociateContextEx
ImmUnlockIMCC
ImmDisableIME
ImmLockIMCC
ImmGetHotKey
ImmNotifyIME
ImmGetIMCCSize
ImmReSizeIMCC
ImmGenerateMessage
ImmCreateIMCC

msimg32

AlphaBlend
TransparentBlt
GradientFill

oleacc

AccessibleObjectFromPoint
AccessibleObjectFromEvent
AccessibleObjectFromWindow
LresultFromObject

winhttp

WinHttpCrackUrl
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse

winmm

timeGetTime

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Exports

Exports

GetHandleVerifier
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeExtension
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
NotifyIMEComMsg

Sections

.text
Size: 9.9MB - Virtual size: 9.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 313KB - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 416KB - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 633KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10e06c2154fdda98c39ce2f9d2f8d24d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

imm32

msimg32

oleacc

winhttp

winmm

crypt32

bcrypt

Exports

Exports

Sections

.text Size: 9.9MB - Virtual size: 9.9MB

.rdata Size: 2.3MB - Virtual size: 2.3MB

.data Size: 313KB - Virtual size: 559KB

.pdata Size: 416KB - Virtual size: 415KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 633KB - Virtual size: 633KB

.reloc Size: 90KB - Virtual size: 89KB

.text
Size: 9.9MB - Virtual size: 9.9MB

.rdata
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 313KB - Virtual size: 559KB

.pdata
Size: 416KB - Virtual size: 415KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 633KB - Virtual size: 633KB

.reloc
Size: 90KB - Virtual size: 89KB