aaac1049a729111f_2648_46871638447142112023

Sharing

Copy URL Twitter E-mail

General

Target

aaac1049a729111f_2648_46871638447142112023
Size

2.1MB
MD5

53db8c0b41357e0658ffcb138035ac64
SHA1

28315cab77ed54c89fb001d58d00f2cfeaa7c528
SHA256

aaac1049a729111f75202222ceed4ef4f36396fcf1650de9a2be5ead1b8c36ab
SHA512

9a505230e8301c1975f9ae8c1b311e9276b3f688f5defa663eee022370817f57a7e1a4e739c31a16d4b5be84934ce0a1f08aabdb6d989b2a846b0d8563d581f3
SSDEEP

24576:OAsGzD9f/qU/1lsmHk+hCfOnbqS7419k0v0p6NnowposK:Oi1f/h1hHhBn747/v0KposK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaac1049a729111f_2648_46871638447142112023

Files

aaac1049a729111f_2648_46871638447142112023
.dll windows:10 windows x86

678727167904f4d26176bcd511066c07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
wcstod
isspace
_except_handler4_common
iswascii
iswcntrl
wcstok_s
??1type_info@@UAE@XZ
isxdigit
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
strstr
strncmp
realloc
wcsstr
wcsrchr
free
wcsnlen
wcsncpy_s
_amsg_exit
_XcptFilter
iswalpha
swprintf_s
wcsncat_s
_itow_s
_wcslwr
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
bsearch
wcschr
wcscpy_s
_CxxThrowException
memcpy
memmove
iswxdigit
wcstoul
wcscat_s
iswdigit
iswalnum
memmove_s
iswspace
wcsncmp
wcstol
_wcsnicmp
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_vsnprintf_s
_errno
wcscspn
_wcslwr_s
memcpy_s
??1exception@@UAE@XZ
_wcsicmp
isalpha
toupper
_snwprintf_s
__CxxFrameHandler3
iswpunct
_vsnwprintf
memset

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObject
OpenSemaphoreW
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockExclusive
CreateSemaphoreExW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InitializeSRWLock
WaitForSingleObjectEx

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CoGetClassObject
IIDFromString
StringFromGUID2
CLSIDFromString
CoRevertToSelf
CoCreateInstance
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoGetApartmentType

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
LoadLibraryExA
LoadLibraryExW
LoadStringW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-localization-l1-2-0

IdnToUnicode
IdnToAscii
GetLocaleInfoEx
FormatMessageW
LCMapStringW
IsDBCSLeadByteEx

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TlsSetValue
GetCurrentProcess
TerminateProcess
GetCurrentThread
GetProcessId
GetThreadId
TlsFree
TlsAlloc
OpenThreadToken
GetCurrentProcessId
TlsGetValue
GetCurrentThreadId
OpenThread

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventWriteTransfer
EventWriteEx
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx
ReadProcessMemory
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
VirtualProtect

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceExW
CompareFileTime
CreateFileW

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetVersionExA
GetTickCount
GetWindowsDirectoryW
GetVersionExW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExA
RegOpenKeyExW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW
SetEnvironmentVariableW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

CreateRestrictedToken
FreeSid
DuplicateTokenEx
GetTokenInformation
CopySid
AddAce
DuplicateToken
CreateWellKnownSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
EqualSid
DeleteAce
AddMandatoryAce
InitializeSid
AddAccessAllowedAceEx
GetSidIdentifierAuthority
GetAclInformation
SetTokenInformation
AllocateAndInitializeSid
GetLengthSid
SetKernelObjectSecurity
GetKernelObjectSecurity
InitializeAcl
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorSacl
GetSidSubAuthority
CheckTokenMembership
GetSecurityDescriptorSacl
GetAce
GetSidSubAuthorityCount
GetSidLengthRequired

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-registry-l2-1-0

RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathIsUNCW
PathSkipRootW
PathFindFileNameW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrTrimW
StrChrNW
StrStrIW
StrStrW
StrCmpNICW
StrCmpNW
StrCmpICW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Module32FirstW

ntdll

RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
NtQuerySystemInformation
RtlGetSuiteMask
RtlImageNtHeaderEx
RtlQueryPackageClaims
NtClose

kernelbase

StrDupW
GlobalAlloc
LocalReAlloc
GlobalFree
lstrcmpA
GetUserDefaultLocaleName
lstrlenW
OpenGlobalizationUserSettingsKey
lstrlenA
StrChrW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-path-l1-1-0

PathCchCombineEx
PathCchRemoveFileSpec
PathAllocCanonicalize
PathCchAppend

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringW
GetStringTypeExW
WideCharToMultiByte

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc

api-ms-win-core-normalization-l1-1-0

GetStringScripts
VerifyScripts

Exports

Exports

CreateIUriBuilder
CreateStringHashN
CreateUri
CreateUriFromMultiByteString
CreateUriPriv
CreateUriWithFragment
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
FastMimeGetFileExtension
FastMimeGetIsMimeFilterEnabled
FastMimeLookupKnownType
FastMimeSetIsMimeFilterEnabled
GetIDNSettingsForIE
GetIUriPriv
GetIUriPriv2
GetPortFromUrlScheme
GetPropertyFromName
GetPropertyName
IEGetFrameUtilExports
IEGetProcessModule
IEGetTabWindowExports
IUriBuilderInternalCreateDomain
ImpersonateUser
IntlPercentEncodeNormalize
IsDWORDProperty
IsStringProperty
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
PrivateCoInternetCanonicalizeIUri
PrivateCoInternetCombineIUri
PrivateCoInternetParseIUri
ResetIDNLanguageData
ResetIEExtensibility
ResetIERegistrySettings
RetiredOrdinal
RevertImpersonate
UriFromHostAndScheme

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isoapis
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

678727167904f4d26176bcd511066c07

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

ntdll

kernelbase

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-normalization-l1-1-0

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.data Size: 10KB - Virtual size: 28KB

.idata Size: 11KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 4KB

.isoapis Size: - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 114KB - Virtual size: 114KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 10KB - Virtual size: 28KB

.idata
Size: 11KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 4KB

.isoapis
Size: - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 114KB - Virtual size: 114KB