cf5a0a949cbdd4ec1f78ae8ef5bc5c19b68ee026ddc839606e606af2751b67af

Sharing

Copy URL Twitter E-mail

General

Target

cf5a0a949cbdd4ec1f78ae8ef5bc5c19b68ee026ddc839606e606af2751b67af
Size

840KB
MD5

bbe69cac0ccc0d638073ff040a1ab26b
SHA1

08676b8dd8ceb15f1a678519153387f50c063e7f
SHA256

cf5a0a949cbdd4ec1f78ae8ef5bc5c19b68ee026ddc839606e606af2751b67af
SHA512

aac76ebfe8e1cf7953d0401582e34ca0847cb0761d9f6074ab503bafe924a8d307264478f08e29112045ffea4315be0a81de2f594623345377da99f8ae4f7019
SSDEEP

24576:WSg1nbPZ5fie8wIP+fnGruV3MOhkZ4vZtO2pCBK:WfnbPLieIWfG6xxvZtOU4K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf5a0a949cbdd4ec1f78ae8ef5bc5c19b68ee026ddc839606e606af2751b67af

Files

cf5a0a949cbdd4ec1f78ae8ef5bc5c19b68ee026ddc839606e606af2751b67af
.dll windows:5 windows x86

51822a083acf4ae2f804310019bd7efc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

pthreadvc2

pthread_create
pthread_cancel
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_exit
pthread_attr_setstacksize
pthread_attr_destroy
pthread_attr_init
sem_post
sem_timedwait
sem_wait
sem_trywait
sem_close
sem_destroy
sem_init
pthread_mutexattr_destroy
pthread_mutex_unlock
pthread_mutex_timedlock
pthread_mutex_destroy
pthread_attr_getschedparam
pthread_mutex_init
pthread_join

kernel32

ReleaseMutex
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualQuery
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
HeapAlloc
GetProcessHeap
HeapFree
CreateProcessA
ReadFile
SizeofResource
LockResource
LoadResource
FindResourceW
GetExitCodeProcess
OutputDebugStringA
HeapReAlloc
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
RaiseException
HeapSize
DecodePointer
MultiByteToWideChar
GetACP
SetLastError
GetModuleFileNameW
GetModuleHandleW
LoadLibraryW
LocalFree
FormatMessageA
GetCurrentThread
GetCurrentThreadId
WideCharToMultiByte
LoadLibraryExW
GlobalDeleteAtom
lstrcmpA
CompareStringA
GlobalAddAtomA
GetCurrentProcessId
EncodePointer
GetSystemDirectoryW
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
SetErrorMode
FileTimeToSystemTime
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
FlushFileBuffers
GetFullPathNameA
SetEndOfFile
WriteFile
WaitForSingleObject
GetVolumeInformationA
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
GetFileAttributesExA
GetSystemTimeAsFileTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
RtlUnwind
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapQueryInformation
DeleteFileW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
GetStdHandle
GetFileType
GetStartupInfoW
IsValidCodePage
CreateDirectoryW
FindFirstFileExW
FindNextFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteConsoleW
GetStringTypeW
LCMapStringW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
CopyFileA
GetLastError
lstrcatA
CloseHandle
lstrlenA
lstrcpyA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateFileA
GetModuleHandleA
GetModuleFileNameA
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
GetFileAttributesA
GetProcAddress
FreeLibrary
LoadLibraryA
CreateDirectoryA
GetTickCount
GetLocalTime
Sleep
CreateMutexA
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
GetVersionExA
RemoveDirectoryW

user32

LoadIconA
LoadIconW
WinHelpA
MonitorFromWindow
GetMonitorInfoA
ShowWindow
SetWindowTextA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorA
ClientToScreen
RealChildWindowFromPoint
SetTimer
KillTimer
InvalidateRect
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetTopWindow
CharUpperA
DestroyMenu
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
LoadBitmapW
GetWindowRect
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
SendMessageA
UnhookWindowsHookEx
PostQuitMessage
PostMessageA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetParent
UnregisterClassA
wsprintfA
GetClassNameA
GetClassLongA
SetWindowLongA
PtInRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
RedrawWindow
SetForegroundWindow
GetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
GetDlgItem
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetWindow
GetWindowTextA
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongA
MessageBoxA
IsWindowEnabled
GetClientRect
RemovePropA
GetPropA
SetPropA
SetMenuItemInfoA
SetCursor
EnableWindow
CallNextHookEx
SetWindowsHookExA
GetCursorPos

gdi32

SetTextColor
SetBkColor
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
CreateBitmap
ExtTextOutA
TextOutA
SetMapMode
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
GetDeviceCaps
DeleteObject
DeleteDC
Escape
GetClipBox
GetStockObject

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegQueryValueA
RegEnumKeyA
RegEnumValueA
RegFlushKey
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shlwapi

PathFindExtensionA
PathIsUNCA
PathStripToRootA
PathFindFileNameA

ole32

CoTaskMemFree
CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize

oleaut32

SysFreeString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen

imagehlp

MakeSureDirectoryPathExists

setupapi

SetupDiSetClassInstallParamsA
CM_Get_DevNode_Status
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiCallClassInstaller

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

psapi

GetProcessMemoryInfo

oleacc

CreateStdAccessibleObject
LresultFromObject

Exports

Exports

CheckModule
Device_Close
Device_GetSystemInfo
Device_GetTrace
Device_Open
Device_OpenEx
Device_Receive
Device_Reset
Device_Send

Sections

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BrmShar
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51822a083acf4ae2f804310019bd7efc

Headers

DLL Characteristics

File Characteristics

Imports

pthreadvc2

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

ole32

oleaut32

imagehlp

setupapi

version

psapi

oleacc

Exports

Exports

Sections

.text Size: 580KB - Virtual size: 580KB

.rdata Size: 163KB - Virtual size: 162KB

.data Size: 38KB - Virtual size: 361KB

.BrmShar Size: 6KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 39KB - Virtual size: 38KB

.text
Size: 580KB - Virtual size: 580KB

.rdata
Size: 163KB - Virtual size: 162KB

.data
Size: 38KB - Virtual size: 361KB

.BrmShar
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 39KB - Virtual size: 38KB