23139a760bb701b46b59f952b5f2e76fee148961fd8f0ba67872ccee8a953e65

Sharing

Copy URL Twitter E-mail

General

Target

23139a760bb701b46b59f952b5f2e76fee148961fd8f0ba67872ccee8a953e65
Size

3.8MB
MD5

e56f74d4828fe77e0ff0881f8fb3af21
SHA1

ad50291ce77352fb8262d657fec0fa0eb5aebc56
SHA256

23139a760bb701b46b59f952b5f2e76fee148961fd8f0ba67872ccee8a953e65
SHA512

b6662f3228ecc0858d255ba1a0157ab63304806e28522ee365b6772a8eae28f239880fe6f5a864228dcd8e6f4086ff61e8d56f37c13cbbcb318c44710769e862
SSDEEP

98304:b6Z2SuYHefEGNcwzlPb/nh8KCjjeOIJLkbGM:LSRefEGdhT6KCjjWM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23139a760bb701b46b59f952b5f2e76fee148961fd8f0ba67872ccee8a953e65

Files

23139a760bb701b46b59f952b5f2e76fee148961fd8f0ba67872ccee8a953e65
.dll windows:6 windows x64

d9689c9c4bbceef6b49c2ea465f6be3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
WritePrivateProfileStringW
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
IsBadCodePtr
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
WriteConsoleW
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
SuspendThread
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
HeapFree
HeapAlloc
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
ExitProcess
CreateDirectoryW
GetFileAttributesExW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
PeekNamedPipe
GetCurrentThreadId
GetCurrentProcess
GetPrivateProfileIntW
lstrcmpiW
GlobalFree
GetCurrentThread
Sleep
GetCurrentProcessId
GetLastError
SetLastError
CreateThread
GetPrivateProfileStringW
DisableThreadLibraryCalls
MoveFileExW
FindClose
FindFirstFileW
IsValidCodePage
CloseHandle
WaitForSingleObjectEx
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
FormatMessageW
SleepEx
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
DeleteFileW
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

RegisterClassExW
SetWindowTextW
GetWindowRect
EnumWindows
GetWindow
GetWindowThreadProcessId
GetClassNameW
ChangeWindowMessageFilterEx
CreateWindowExW
SendMessageW
DefWindowProcW
PostQuitMessage

shell32

ShellExecuteW
CommandLineToArgvW

shlwapi

PathIsDirectoryW

ws2_32

getsockname
getpeername
connect
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
htons

wldap32

ord33
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord35
ord79
ord30
ord200
ord301
ord32

crypt32

CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA

Sections

.text
Size: - Virtual size: 931KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

..7#
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.EI`
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.s65
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9689c9c4bbceef6b49c2ea465f6be3d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

ws2_32

wldap32

crypt32

advapi32

Sections

.text Size: - Virtual size: 931KB

.rdata Size: - Virtual size: 208KB

.data Size: - Virtual size: 30KB

.pdata Size: - Virtual size: 37KB

.detourc Size: - Virtual size: 8KB

.detourd Size: - Virtual size: 24B

_RDATA Size: - Virtual size: 348B

..7# Size: - Virtual size: 1.4MB

.EI` Size: 3KB - Virtual size: 2KB

.s65 Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 512B - Virtual size: 224B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 931KB

.rdata
Size: - Virtual size: 208KB

.data
Size: - Virtual size: 30KB

.pdata
Size: - Virtual size: 37KB

.detourc
Size: - Virtual size: 8KB

.detourd
Size: - Virtual size: 24B

_RDATA
Size: - Virtual size: 348B

..7#
Size: - Virtual size: 1.4MB

.EI`
Size: 3KB - Virtual size: 2KB

.s65
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 512B - Virtual size: 224B

.rsrc
Size: 1KB - Virtual size: 1KB