e1a728959cfd83d9343b0c1dc91093be24353b4e79b95e1eec97abcd05477c19

Sharing

Copy URL Twitter E-mail

General

Target

e1a728959cfd83d9343b0c1dc91093be24353b4e79b95e1eec97abcd05477c19
Size

529KB
MD5

9ed7a0f6e380665e0026a49cb8d150f9
SHA1

3d30a8dc5093b452d779cea7e72c803b7593e19d
SHA256

e1a728959cfd83d9343b0c1dc91093be24353b4e79b95e1eec97abcd05477c19
SHA512

a3369d4de93965c6361b7add933bf5bd0bb84f5653bd54284870d1eea210402fed7141393850df462500a6ffea3911c14404203595126b076c2a720a39f38d54
SSDEEP

12288:ufNx4kuec/klE7rQ82dj2EbueDUeTDDb4hq8rUuj:obzuec/kurQ8G2EJYeb8M8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1a728959cfd83d9343b0c1dc91093be24353b4e79b95e1eec97abcd05477c19

Files

e1a728959cfd83d9343b0c1dc91093be24353b4e79b95e1eec97abcd05477c19
.dll windows:6 windows x64

85c43ac561367aa2f53b8bc51760956d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
LocalFileTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
CompareStringW
GetCPInfo
MultiByteToWideChar
IsDBCSLeadByte
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetCurrentDirectoryW
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
DosDateTimeToFileTime
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
SetThreadAffinityMask
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
ResumeThread
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
GetVersionExW
FindClose
FindFirstFileW
SetFileAttributesW
GetFileAttributesW
GetFileType
SetFilePointer
GetStdHandle
ReadFile
CloseHandle
DeleteFileW
CreateFileW
CreateHardLinkW
SetFileTime
RemoveDirectoryW
DeviceIoControl
GetCurrentProcess
CreateDirectoryW
GetLastError
Sleep
AreFileApisANSI
InitializeCriticalSectionEx
InitializeSListHead
DisableThreadLibraryCalls
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitOnceBeginInitialize
InitOnceComplete
IsDebuggerPresent
OutputDebugStringW
GetTickCount64
SetLastError

user32

CharUpperW
CharLowerW
CharToOemBuffW
CharToOemA
OemToCharBuffA
OemToCharA

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
SetFileSecurityW

ole32

CoCreateGuid

oleaut32

SysAllocString
VariantClear
SysAllocStringLen
VariantCopy
SysStringLen
SysFreeString

zlib1

inflateInit2_
crc32
inflateReset
inflate
inflateEnd

shared

uFormatSystemErrorMessage
stricmp_utf8
GetInfiniteWaitEvent
uGetTempPath
uPrintCrashInfo_OnEvent
uBugCheck
??1uCallStackTracker@@QEAA@XZ
??0uCallStackTracker@@QEAA@PEBD@Z

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Xbad_function_call@std@@YAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list
__std_exception_destroy
_CxxThrowException
__current_exception_context
__current_exception
strrchr
__C_specific_handler
strstr
memmove
memset
memcmp
wcsrchr
strchr
wcschr
__std_exception_copy
__std_terminate
_purecall
memcpy

api-ms-win-crt-runtime-l1-1-0

abort
_beginthreadex
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
exit
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

wcsncpy
strncpy
strncmp
wcsncat
towupper
strlen
wcsncmp
wcspbrk
_strdup
_wcsicmp

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_callnewh
free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

lround

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 431KB - Virtual size: 430KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85c43ac561367aa2f53b8bc51760956d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

zlib1

shared

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 431KB - Virtual size: 430KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 4KB - Virtual size: 32KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 472B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 431KB - Virtual size: 430KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 4KB - Virtual size: 32KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 472B

.reloc
Size: 3KB - Virtual size: 3KB