1eb07d6e2f629dba2ca40ca0e3a3646d25ff34c4ff9df2b11b030a1ecd243453

Sharing

Copy URL Twitter E-mail

General

Target

1eb07d6e2f629dba2ca40ca0e3a3646d25ff34c4ff9df2b11b030a1ecd243453
Size

3.3MB
MD5

00037dbfe630891b0004e6fbeace5a45
SHA1

c5d862c985bcb2239c6b0322cf73b6c3c4a95f53
SHA256

1eb07d6e2f629dba2ca40ca0e3a3646d25ff34c4ff9df2b11b030a1ecd243453
SHA512

ee3a104ba7d4679856aa04be315fcc9b96435a0b2544878d7aa2a58524222be8888f62b0982891d2569c38c94d08c8c61107a0712ab5d449f909efa632a0d2ca
SSDEEP

49152:pg6oTo+1EyWcr2Crk5eH6O1aWeb8Xzf6VfjpkT1upC0FP2KVkez+h+c3wJYUV:pg6os8rk5Vmipjr7EKO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1eb07d6e2f629dba2ca40ca0e3a3646d25ff34c4ff9df2b11b030a1ecd243453

Files

1eb07d6e2f629dba2ca40ca0e3a3646d25ff34c4ff9df2b11b030a1ecd243453
.dll windows:6 windows x86

040157f32120d052f025fcf29516f090

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

listen
htonl
getsockname
connect
bind
recv
select
__WSAFDIsSet
socket
htons
WSAIoctl
accept
gethostname
ioctlsocket
getpeername
setsockopt
inet_ntop
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
getaddrinfo
sendto
recvfrom
freeaddrinfo

crypt32

CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertGetIntendedKeyUsage
CertCloseStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext

wldap32

ord22
ord301
ord35
ord32
ord27
ord26
ord41
ord79
ord50
ord45
ord60
ord211
ord200
ord46
ord33
ord217
ord30
ord143

normaliz

IdnToAscii

kernel32

GetCurrentProcess
SwitchToThread
GetSystemInfo
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
SwitchToFiber
DeleteFiber
CreateFiber
CreateFileW
DeleteFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
LoadLibraryW
GetACP
OutputDebugStringA
GetCurrentThread
GetVersionExW
LoadLibraryExW
GlobalAlloc
GlobalLock
GlobalDeleteAtom
lstrcmpA
lstrcmpW
SetEvent
CreateEventW
SetThreadPriority
DuplicateHandle
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalAddAtomW
GlobalUnlock
GlobalFree
MulDiv
EncodePointer
GetSystemDirectoryW
FreeResource
GlobalFindAtomW
CompareStringW
InitializeCriticalSection
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
SetErrorMode
GetCurrentDirectoryW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
FlushFileBuffers
Sleep
GetFullPathNameW
GetVolumeInformationW
FileTimeToSystemTime
VirtualProtect
FileTimeToLocalFileTime
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
GetUserDefaultLCID
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetEndOfFile
GetFileSizeEx
FindNextFileA
GetCPInfo
FindClose
CreateFileA
SearchPathW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
SetFileAttributesW
GetFileAttributesW
FormatMessageW
SetLastError
WriteFile
GetFileType
GetEnvironmentVariableW
GetStdHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStartupInfoA
CreateProcessA
PeekNamedPipe
CreatePipe
CloseHandle
ReadFile
GetEnvironmentVariableA
OutputDebugStringW
GetExitCodeThread
TryEnterCriticalSection
SetFilePointerEx
LocalFree
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetNativeSystemInfo
GetComputerNameExW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
SetConsoleCtrlHandler
GetDriveTypeW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
HeapQueryInformation
AreFileApisANSI
LCMapStringW
GetStringTypeW
ReleaseSemaphore
GetModuleFileNameA
SetEnvironmentVariableA
RemoveDirectoryW
GetConsoleCP
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
SetStdHandle
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualAlloc
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx

user32

DestroyMenu
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
CharUpperW
LoadCursorW
GetSysColorBrush
GetSystemMetrics
ReleaseDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
IsDialogMessageW
SetWindowTextW
ShowWindow
MonitorFromWindow
WinHelpW
LoadIconW
UnhookWindowsHookEx
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
GetWindowTextW
RemovePropW
GetPropW
SetPropW
GetScrollPos
RedrawWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
GetDlgItem
IsIconic
EndDeferWindowPos
DeferWindowPos
SetWindowPos
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetMonitorInfoW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
SetFocus
IsWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
EnableWindow
SetCursor
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
SendMessageW
PostQuitMessage
PostMessageW
GetParent
OffsetRect
SetRectEmpty
GetClientRect
SendDlgItemMessageA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
UnregisterClassW
BeginDeferWindowPos

gdi32

DeleteObject
ScaleWindowExtEx
ScaleViewportExtEx
GetObjectW
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
SetMapMode
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
GetStockObject
GetClipBox
Escape
DeleteDC
CreateBitmap
GetDeviceCaps
SetBkColor
SetTextColor

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteW
SHGetKnownFolderPath

shlwapi

PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoCreateGuid
CoInitialize
CoTaskMemFree

oleaut32

SysAllocString
VariantInit
VariantChangeType
VariantClear
SysFreeString

iphlpapi

GetIfTable2
GetAdaptersAddresses
FreeMibTable

bcrypt

BCryptGenRandom

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

PlugInMain

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 675KB - Virtual size: 675KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

040157f32120d052f025fcf29516f090

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wldap32

normaliz

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

iphlpapi

bcrypt

oleacc

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 675KB - Virtual size: 675KB

.data Size: 40KB - Virtual size: 65KB

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 118KB - Virtual size: 118KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 675KB - Virtual size: 675KB

.data
Size: 40KB - Virtual size: 65KB

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 118KB - Virtual size: 118KB