ad9df79d2732f3fa97ecd7faa551d5208420a12c4e374628f08fbb9eaac7c65a

Sharing

Copy URL Twitter E-mail

General

Target

ad9df79d2732f3fa97ecd7faa551d5208420a12c4e374628f08fbb9eaac7c65a
Size

4.1MB
MD5

d7ac29782b8e3f680fe7cad9644d786a
SHA1

ba91907b6e1e9b97c5d9fbeaa4c1fd3a47e1a616
SHA256

ad9df79d2732f3fa97ecd7faa551d5208420a12c4e374628f08fbb9eaac7c65a
SHA512

0540235b2cf4546739b869316ac74120eeba0e781ccc2a6d34e5879cad941dbc75737c5db0e5c424a1af9388da39e5fb5d700a9efe25b97486f65d53d2da401a
SSDEEP

98304:tlzendnenn8iu1HpcR/FyfaVIiWCAfvzapxm4DWD:Petenn8BHaR/FyfaVIihAfvQrD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad9df79d2732f3fa97ecd7faa551d5208420a12c4e374628f08fbb9eaac7c65a

Files

ad9df79d2732f3fa97ecd7faa551d5208420a12c4e374628f08fbb9eaac7c65a
.dll windows:6 windows x86

7341df9c2769c25340168f3b6f69c39a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

lz4

LZ4_decompress_safe_continue
LZ4_compressBound
LZ4_setStreamDecode
LZ4_freeStreamDecode
LZ4_createStream
LZ4_freeStream
LZ4_loadDict
LZ4_compress_fast_continue
LZ4_createStreamHC
LZ4_freeStreamHC
LZ4_loadDictHC
LZ4_compress_HC_continue
LZ4_resetStreamHC
LZ4_createStreamDecode

snappy

?GetUncompressedLength@snappy@@YA_NPBDIPAI@Z
?RawCompress@snappy@@YAXPBDIPADPAI@Z
?MaxCompressedLength@snappy@@YAII@Z
?RawUncompress@snappy@@YA_NPBDIPAD@Z

zlib1

inflate
inflateSetDictionary
inflateInit2_
deflate
deflateEnd
deflateSetDictionary
deflateBound
deflateInit2_
inflateEnd

zstd

ZSTD_isError
ZSTD_freeCDict
ZSTD_decompress_usingDict
ZSTD_decompress_usingDDict
ZSTD_createDCtx
ZSTD_versionNumber
ZSTD_freeDCtx
ZSTD_compressBound
ZSTD_createCCtx
ZSTD_freeCCtx
ZSTD_CCtx_setParameter
ZSTD_compress2
ZSTD_createCDict
ZSTD_freeDDict
ZSTD_CCtx_loadDictionary
ZSTD_CCtx_refCDict
ZSTD_createDDict_byReference
ZDICT_trainFromBuffer
ZDICT_finalizeDictionary
ZDICT_isError
ZSTD_sizeof_DDict
ZSTD_CCtx_reset
ZSTD_DCtx_reset
ZSTD_compressStream2
ZSTD_decompressStream
ZSTD_getErrorName

rpcrt4

RpcStringFreeA
UuidCreateSequential
UuidToStringA

shlwapi

PathIsRelativeA
PathIsDirectoryA

kernel32

FormatMessageA
WriteConsoleW
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
ReadConsoleW
GetFileSizeEx
HeapSize
HeapReAlloc
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeZoneInformation
GetFileType
GetStdHandle
HeapAlloc
HeapFree
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RtlUnwind
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetCPInfo
GetStringTypeW
InitializeSRWLock
CreateFileA
FindClose
FindFirstFileExA
FindNextFileA
SetFileInformationByHandle
CloseHandle
GetLastError
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentDirectoryA
CreateDirectoryA
DeleteFileA
GetDiskFreeSpaceExA
GetFileAttributesExA
RemoveDirectoryA
SetFilePointerEx
SetFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
DeviceIoControl
GetCurrentThreadId
GetSystemInfo
GetSystemTimeAsFileTime
MapViewOfFileEx
GetModuleHandleA
GetProcAddress
CreateFileMappingA
MoveFileExA
CreateHardLinkA
GetComputerNameA
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
WaitForSingleObject
GetCurrentThread
GetThreadId
TlsAlloc
TlsGetValue
TlsSetValue
FlushFileBuffers
ReadFile
WriteFile
FlushViewOfFile
UnmapViewOfFile
LocalFree
MapViewOfFile
TryAcquireSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
WideCharToMultiByte
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
SwitchToThread
GetNativeSystemInfo
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetModuleHandleW

Exports

Exports

Iterator_Current
Iterator_Destroy
Iterator_Newiterator
Iterator_NewiteratortoTXN
Iterator_Next
Iterator_Prev
Iterator_Scope
Iterator_ScopeEX
Iterator_Seek
Iterator_SeekToFirst
Iterator_SeekToLast
Iterator_Seek_d
Iterator_Total
Iterator_Vague
Iterator_Valid
Transaction_Delete
Transaction_DeleteW
Transaction_Destroy
Transaction_Merge_byte
Transaction_Merge_char
Transaction_Merge_double
Transaction_Merge_int
Transaction_Newiterator
Transaction_Put_String
Transaction_Put_bool
Transaction_Put_byte
Transaction_Put_byteW
Transaction_Put_double
Transaction_Put_int
Transaction_Put_longlongint
Transaction_Rollback
Transaction_Write
Transaction_get_String
Transaction_get_bool
Transaction_get_byte
Transaction_get_byteW
Transaction_get_double
Transaction_get_int
Transaction_get_longlongint
WriteBatch_Count
WriteBatch_Delete
WriteBatch_DeleteW
WriteBatch_Destroy
WriteBatch_Newiterator
WriteBatch_Put_String
WriteBatch_Put_bool
WriteBatch_Put_byte
WriteBatch_Put_byte_byte
WriteBatch_Put_double
WriteBatch_Put_int
WriteBatch_Put_longlongint
WriteBatch_Release
WriteBatch_Write
iterator_get_key
iterator_get_key_byte
iterator_get_value
iterator_get_value_bool
iterator_get_value_byte
iterator_get_value_double
iterator_get_value_int
iterator_get_value_longlongint
rocksdb_Clear
rocksdb_ColumnFamily_Destroy
rocksdb_ColumnFamily_Exist
rocksdb_CreateColumnFamily
rocksdb_Delete
rocksdb_DeleteW
rocksdb_Exist
rocksdb_ExistW
rocksdb_Flush
rocksdb_Freed
rocksdb_GetSnapshot
rocksdb_Merge_byte
rocksdb_Merge_char
rocksdb_Merge_double
rocksdb_Merge_int
rocksdb_ReleaseSnapshot
rocksdb_add_String
rocksdb_add_bool
rocksdb_add_byte
rocksdb_add_byteW
rocksdb_add_double
rocksdb_add_int
rocksdb_add_longlongint
rocksdb_get_String
rocksdb_get_bool
rocksdb_get_byte
rocksdb_get_byteeW
rocksdb_get_double
rocksdb_get_int
rocksdb_get_longlongint
rocksdb_getallkey
rocksdb_getkey_number
rocksdb_init
rocksdb_optimisticTransactionDB_Clear
rocksdb_optimisticTransactionDB_Delete
rocksdb_optimisticTransactionDB_DeleteW
rocksdb_optimisticTransactionDB_Exist
rocksdb_optimisticTransactionDB_ExistW
rocksdb_optimisticTransactionDB_Flush
rocksdb_optimisticTransactionDB_Freed
rocksdb_optimisticTransactionDB_GetSnapshot
rocksdb_optimisticTransactionDB_Merge_byte
rocksdb_optimisticTransactionDB_Merge_char
rocksdb_optimisticTransactionDB_Merge_double
rocksdb_optimisticTransactionDB_Merge_int
rocksdb_optimisticTransactionDB_ReleaseSnapshot
rocksdb_optimisticTransactionDB_add_String
rocksdb_optimisticTransactionDB_add_bool
rocksdb_optimisticTransactionDB_add_byte
rocksdb_optimisticTransactionDB_add_byteW
rocksdb_optimisticTransactionDB_add_double
rocksdb_optimisticTransactionDB_add_int
rocksdb_optimisticTransactionDB_add_longlongint
rocksdb_optimisticTransactionDB_get_String
rocksdb_optimisticTransactionDB_get_bool
rocksdb_optimisticTransactionDB_get_byte
rocksdb_optimisticTransactionDB_get_byteeW
rocksdb_optimisticTransactionDB_get_double
rocksdb_optimisticTransactionDB_get_int
rocksdb_optimisticTransactionDB_get_longlongint
rocksdb_optimisticTransactionDB_getallkey
rocksdb_optimisticTransactionDB_getkey_number
rocksdb_optimisticTransactionDB_init
rocksdb_optimisticTransactionDB_stop
rocksdb_stop
rocksdb_transactionDB_Clear
rocksdb_transactionDB_Delete
rocksdb_transactionDB_DeleteW
rocksdb_transactionDB_Exist
rocksdb_transactionDB_ExistW
rocksdb_transactionDB_Flush
rocksdb_transactionDB_Freed
rocksdb_transactionDB_GetSnapshot
rocksdb_transactionDB_Merge_byte
rocksdb_transactionDB_Merge_char
rocksdb_transactionDB_Merge_double
rocksdb_transactionDB_Merge_int
rocksdb_transactionDB_ReleaseSnapshot
rocksdb_transactionDB_add_String
rocksdb_transactionDB_add_bool
rocksdb_transactionDB_add_byte
rocksdb_transactionDB_add_byteW
rocksdb_transactionDB_add_double
rocksdb_transactionDB_add_int
rocksdb_transactionDB_add_longlongint
rocksdb_transactionDB_get_String
rocksdb_transactionDB_get_bool
rocksdb_transactionDB_get_byte
rocksdb_transactionDB_get_byteeW
rocksdb_transactionDB_get_double
rocksdb_transactionDB_get_int
rocksdb_transactionDB_get_longlongint
rocksdb_transactionDB_getallkey
rocksdb_transactionDB_getkey_number
rocksdb_transactionDB_init
rocksdb_transactionDB_stop

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 435KB - Virtual size: 434KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7341df9c2769c25340168f3b6f69c39a

Headers

DLL Characteristics

File Characteristics

Imports

lz4

snappy

zlib1

zstd

rpcrt4

shlwapi

kernel32

Exports

Exports

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 435KB - Virtual size: 434KB

.data Size: 36KB - Virtual size: 46KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 130KB - Virtual size: 129KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 435KB - Virtual size: 434KB

.data
Size: 36KB - Virtual size: 46KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 130KB - Virtual size: 129KB