80ba6d0dac8fa170bbea00823215bd43c20b909e4ae561a7e3775e3b4baa2310

Sharing

Copy URL Twitter E-mail

General

Target

80ba6d0dac8fa170bbea00823215bd43c20b909e4ae561a7e3775e3b4baa2310
Size

4.0MB
MD5

2023ccbd6ae40f50598ccd9c56f0bbb7
SHA1

218a67e9e5451396f848b4ae07e3a1819aa4d87b
SHA256

80ba6d0dac8fa170bbea00823215bd43c20b909e4ae561a7e3775e3b4baa2310
SHA512

dfe0acbad0cab40f0c5b8a9b5eac99210bd9d382f3fe36b51be39f9fce36fe3ecf2e2f3adf9d6a36b81211d51f0a53f2ba73afbf1e178089db9fc62e5e1bfd71
SSDEEP

49152:7/9X181KuEVjgxO7K4eVajs4j9yKuRAUV+O6ei8DXTHmGha9bV3TOlp:j9Xau4MO6ROp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80ba6d0dac8fa170bbea00823215bd43c20b909e4ae561a7e3775e3b4baa2310

Files

80ba6d0dac8fa170bbea00823215bd43c20b909e4ae561a7e3775e3b4baa2310
.dll windows:6 windows x64

b1d9f940de9e57039e6dc0fa699202d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

comctl32

ord17

kernel32

GetTempFileNameW
GetFileTime
DeleteFileW
GetTempPathW
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
GetVersionExA
CloseHandle
GetLastError
HeapDestroy
HeapAlloc
DeleteCriticalSection
InitializeCriticalSectionEx
DecodePointer
SetFileTime
GetFileAttributesW
GetFileAttributesA
WideCharToMultiByte
CopyFileW
FindResourceW
SizeofResource
Sleep
GetProcessHeap
HeapSize
HeapFree
CreateFileW
HeapReAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
OutputDebugStringA
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
LocalFree
FormatMessageW
WritePrivateProfileStringW
lstrlenW
lstrcpynW
lstrcpyW
GetPrivateProfileStringW
GetLocaleInfoW
GetNumberFormatW
CreateFileA
GetFileSize
lstrlenA
lstrcpynA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalFree
lstrcatW
lstrcpyA
lstrcatA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
LockResource
LoadResource
OutputDebugStringW
GetVolumeInformationW
FindResourceExW
GetDriveTypeW
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
CreateDirectoryW
CreateDirectoryA
FindFirstFileW
lstrcmpW
FindNextFileW
FindClose
RemoveDirectoryW
GetVersionExW
GetUserDefaultLCID
GetTickCount
GetFullPathNameW
SetFilePointer
WriteFile
SetEndOfFile
SetFileAttributesW
_lcreat
_lwrite
_lclose
LoadLibraryW
FreeLibrary
GetVersion
lstrcmpiW
FreeResource
GetModuleFileNameW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
SystemTimeToFileTime
CompareFileTime
MoveFileW
QueryPerformanceFrequency
QueryPerformanceCounter
GetShortPathNameW
ReadFile
GetFileSizeEx
GetLongPathNameW
SetFilePointerEx
CompareStringW
GetACP
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
GetCurrentThreadId
OpenThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CreateSemaphoreA
GetUserDefaultLangID
IsDebuggerPresent
RaiseException
FormatMessageA
EncodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetCurrentThread
GetStdHandle
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
SetConsoleCtrlHandler
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FindResourceA

user32

SetCursorPos
ReleaseCapture
MessageBoxW
wsprintfA
OemToCharA
CharToOemA
CharNextW
GetWindowTextW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetIconInfo
PtInRect
ScrollWindowEx
UpdateWindow
InvalidateRgn
SetMenu
GetMenuItemCount
GetMenuItemID
wsprintfW
GetSubMenu
CharPrevW
RegisterClipboardFormatW
GetClipboardData
DestroyIcon
ClientToScreen
EnumWindows
GetDlgItemTextW
SetDlgItemTextW
WaitMessage
PeekMessageW
SetRect
SetCapture
ClipCursor
ScreenToClient
WindowFromPoint
GetCursorPos
GetClientRect
MonitorFromRect
IsWindow
GetParent
InvalidateRect
UnregisterClassW
SetWindowLongPtrW
GetWindowLongPtrW
IsDlgButtonChecked
CheckDlgButton
EndDialog
DialogBoxParamW
SendMessageW
LoadStringA
LoadStringW
SystemParametersInfoA
OffsetRect
IntersectRect
GetWindowRect
GetSystemMetrics
IsIconic
GetWindowPlacement
ReleaseDC
SetWindowPos
GetWindowLongW
SetWindowLongW
EnumDisplayDevicesW
GetDesktopWindow
SetWindowPlacement
ShowWindow
EqualRect
GetDC
EnumChildWindows
LoadCursorW
SetCursor
GetMonitorInfoW
GetWindow
MonitorFromWindow
DeleteMenu

gdi32

GetObjectW
SelectPalette
RealizePalette
GetDIBits
DeleteObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteDC
GetDCOrgEx
GetClipBox
PatBlt
TranslateCharsetInfo
CreateRectRgn
CombineRgn
GetDeviceCaps
GetStockObject

shlwapi

PathFileExistsW
PathAppendW
PathAppendA
PathRemoveFileSpecA
PathRemoveFileSpecW
PathStripToRootA
PathAddBackslashA
PathStripToRootW
PathAddBackslashW
PathFindFileNameW
StrCmpLogicalW
PathFindExtensionW
StrCpyW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegSetValueExA
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegDeleteKeyW
RegOpenKeyW
RegOpenKeyExA

shell32

SHBrowseForFolderW
SHGetFileInfoW
SHGetSettings
SHFileOperationW
ShellExecuteW
ExtractIconExW
SHGetPathFromIDListW

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantInit
SysStringByteLen
SysAllocStringByteLen
VariantTimeToSystemTime
VarDateFromStr
SysFreeString
VariantChangeType
VariantClear

Exports

Exports

IEP_Free
IEP_GetDefaultEncodeParams
IEP_GetNativelySupportedMetadata
IEP_GetPlugInInfo
IEP_GetSupportedMetadata
IEP_GetValidPixelFormats
IEP_Help
IEP_ImageEncode
IEP_Init
IEP_SetEncodingInfo
IEP_SetMetadataList
IEP_SetMetadataListW
IEP_ShowEncodeParamsDialog
IEP_ShowPlugInDialog

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1d9f940de9e57039e6dc0fa699202d7

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

shlwapi

version

advapi32

shell32

oleaut32

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 707KB - Virtual size: 706KB

.data Size: 42KB - Virtual size: 197KB

.pdata Size: 130KB - Virtual size: 129KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 426KB - Virtual size: 425KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 707KB - Virtual size: 706KB

.data
Size: 42KB - Virtual size: 197KB

.pdata
Size: 130KB - Virtual size: 129KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 426KB - Virtual size: 425KB

.reloc
Size: 16KB - Virtual size: 15KB