ad94ba37f134bd7c4f07fd00b1d34a27f47b561ded3a9cb6491805bcf1332cb8

Sharing

Copy URL

Twitter E-mail

General

Target

ad94ba37f134bd7c4f07fd00b1d34a27f47b561ded3a9cb6491805bcf1332cb8
Size

1.7MB
MD5

e27b12c425f33240a6320b1708bd2df9
SHA1

b291e3ac70e90a04827a9941a574f0a250f76129
SHA256

ad94ba37f134bd7c4f07fd00b1d34a27f47b561ded3a9cb6491805bcf1332cb8
SHA512

8ab323a6bd0ae89da8b3d709bc3106a321ff050b31801813aba0e528b698d80e62f960b114382f40bf9c0c33fd5c1f5028ef001751a3c3fa295e22dd31eb2096
SSDEEP

24576:0q6oAmBQa0p1BfAf+NHifHOyGRPDbp0Gp59mjUBRMQHZ7FkJGqQGnqubwugM+5m:0/awpdGGNLJZ7F8XqubFgM+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad94ba37f134bd7c4f07fd00b1d34a27f47b561ded3a9cb6491805bcf1332cb8

Files

ad94ba37f134bd7c4f07fd00b1d34a27f47b561ded3a9cb6491805bcf1332cb8
.dll windows:6 windows x64

be93d712f9ff6508c26773bded59f08d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

dbghelp

MakeSureDirectoryPathExists

shlwapi

PathFileExistsW

shell32

SHGetFolderPathW

kernel32

LocalFree
GetTickCount
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
LoadLibraryW
DeleteFileW
GetVersionExW
HeapDestroy
GetFileAttributesA
LeaveCriticalSection
HeapCreate
HeapValidate
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
GetVersionExA
CloseHandle
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
FindNextFileW
RemoveDirectoryW
LocalAlloc
FindClose
MultiByteToWideChar
GetFileAttributesW
CopyFileW
WideCharToMultiByte
FindFirstFileW
GetLastError
Sleep
CreateDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableA
FormatMessageW
GetStringTypeW
EncodePointer
DecodePointer
GetCPInfo
GetCommandLineA
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsGetValue
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCurrentThread
GetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FileTimeToLocalFileTime
FindFirstFileExW
GetDriveTypeW
FileTimeToSystemTime
GetTimeZoneInformation
ReadConsoleW
GetThreadTimes
InitializeSListHead
SetStdHandle
WriteConsoleW
GetFileInformationByHandle
PeekNamedPipe

advapi32

QueryServiceConfigW
ControlService
UnlockServiceDatabase
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
LockServiceDatabase
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
CreateWellKnownSid
CheckTokenMembership
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

Exports

Exports

GetHraIniValue
GetHraInstallPathByServiceName
GetHraInstalledIpcInterfaceVersion
GetHraInstalledVersion
GetHraLoadedPatternVersion
GetHraServiceStatus
GetHraZipIniValue
GetHraZipIpcInterfaceVersion
GetHraZipVersion
HraAutoInstall
HraAutoInstallEX
HraCreateService
HraCreateServiceEX
HraInst_CheckTokenMembership
HraInst_CopyDirectory
HraInst_GetParam
HraInst_GetProgramDataDir
HraInst_GetRegValue
HraInst_IsAdmin
HraInst_IsDirExists
HraInst_JsontoWString
HraInst_LTrim
HraInst_RTrim
HraInst_RemoveDirectory
HraInst_RemoveDirectory_WithException
HraInst_StringToUnicode
HraInst_Trim
HraInst_UnicodeToString
HraInst_Unzip
HraInst_WStringtoJson
HraInstall
HraInstallEX
HraStart
HraStop
HraUninstall
HraUninstallEX
IsHraInstalled
WinSrv_ChangeConfig
WinSrv_Create
WinSrv_Delete
WinSrv_Exists
WinSrv_QueryBinaryPathName
WinSrv_QueryStatus
WinSrv_StartService
WinSrv_StopService

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be93d712f9ff6508c26773bded59f08d

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

shlwapi

shell32

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 257KB - Virtual size: 256KB

.data Size: 31KB - Virtual size: 43KB

.pdata Size: 70KB - Virtual size: 70KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 257KB - Virtual size: 256KB

.data
Size: 31KB - Virtual size: 43KB

.pdata
Size: 70KB - Virtual size: 70KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB