ad43aa4974e065f1_2648_1500636447142112023

Sharing

Copy URL Twitter E-mail

General

Target

ad43aa4974e065f1_2648_1500636447142112023
Size

487KB
MD5

83f2e6a96b760e60b454df293ea3b378
SHA1

47b4443712882b85630e04686a84552ee2bac631
SHA256

ad43aa4974e065f1c0089387cf9843f44a8c0c2a788e1f9c0af00bb80dc97c8b
SHA512

2d0ce0f83eb9643a2750214099ddbf9fa7cb26b59b3fe6e5ce58cec16e21f7e4efc0258a824a5c50d9bcef4d77fd298a97e5d39b239e9fea386600ef3fff9e20
SSDEEP

12288:9XZkNO4CdLe8PiJgEYCGirvJVSHs0gXa2SZjPHr:0ce8PiJrYdirvzS72SZjPH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad43aa4974e065f1_2648_1500636447142112023

Files

ad43aa4974e065f1_2648_1500636447142112023
.dll regsvr32 windows:10 windows x86

d82d4d2327b8bd51f2ccea2054dde33a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

malloc
free
wcsncmp
_stricmp
_wmakepath_s
_vsnprintf
_XcptFilter
_i64tow_s
_wstrtime
_purecall
_waccess
_wstrdate
_wtol
qsort
wcschr
wcstombs
mbstowcs
towupper
wcsstr
_wcslwr
wcstol
wcsrchr
_vsnprintf_s
_amsg_exit
realloc
_initterm
_wsplitpath_s
_except_handler4_common
_ltow
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__CxxFrameHandler3
_lock
_unlock
__dllonexit
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_onexit
memmove
memcpy
??1exception@@UAE@XZ
_wcsicmp
memcpy_s
memcmp
_vsnwprintf
_local_unwind4
_CxxThrowException
_wcsnicmp
memset

ntdll

NtQueryEvent
RtlImageNtHeader
NtOpenEvent
RtlInitUnicodeString
RtlAllocateHeap
RtlWow64IsWowGuestMachineSupported
NtQueryInformationProcess
WinSqmSetDWORD
RtlFreeHeap

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegFlushKey
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW

api-ms-win-core-com-l1-1-0

CoCreateInstanceEx
StringFromGUID2
CoCreateInstance
CoGetCallContext
CoGetMalloc
CoTaskMemFree
StringFromCLSID
CoSetProxyBlanket
CoGetObjectContext
CoCreateGuid
CLSIDFromString
CreateStreamOnHGlobal
CoRevertToSelf
CoTaskMemRealloc
CoTaskMemAlloc
CoImpersonateClient

api-ms-win-core-libraryloader-l1-2-0

LoadResource
FindResourceExW
GetModuleFileNameW
LockResource
LoadStringW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup
GetTokenInformation
AddAccessAllowedAce
InitializeSecurityDescriptor
AddAccessDeniedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetLengthSid
GetSecurityDescriptorLength
InitializeAcl
GetAclInformation
GetSecurityDescriptorDacl
DuplicateTokenEx

api-ms-win-core-processthreads-l1-1-0

SetThreadStackGuarantee
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetExitCodeProcess
TerminateProcess
GetCurrentThreadId
SetThreadToken
GetCurrentThread
CreateProcessAsUserW
OpenThreadToken
CreateProcessW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCurrentDirectoryW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemDirectoryW
GetLocalTime
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte
FormatMessageW
GetSystemDefaultLCID

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery
UnmapViewOfFile
OpenFileMappingW
VirtualProtect
VirtualFree
VirtualAlloc
MapViewOfFile
CreateFileMappingW

api-ms-win-core-file-l2-1-0

MoveFileWithProgressW
MoveFileExW

api-ms-win-core-file-l1-1-0

FindClose
FindNextFileW
FindFirstFileW
SetEndOfFile
CreateFileW
GetTempFileNameW
SetFilePointer
WriteFile
DeleteFileW
GetFileAttributesW
ReadFile
GetFileSizeEx
GetFileType
CreateDirectoryW
SetFileAttributesW
GetLongPathNameW
FlushFileBuffers

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-security-base-private-l1-1-0

MakeAbsoluteSD2

api-ms-win-core-com-private-l1-1-0

CLSIDFromOle1Class
CoGetModuleType

rpcrt4

UuidFromStringW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-processthreads-l1-1-1

GetThreadContext

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernel32

GetComputerNameW

Exports

Exports

ActivatorUpdateForIsRouterChanges
CLSIDFromStringByBitness
CheckMemoryGates
CoRegCleanup
ComPlusEnablePartitions
ComPlusEnableRemoteAccess
ComPlusMigrate
ComPlusPartitionsEnabled
ComPlusRemoteAccessEnabled
CreateComponentLibraryEx
DeleteAllActivatorsForClsid
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DowngradeAPL
GetCatalogObject
GetCatalogObject2
GetComputerObject
GetGlobalBabyJITEnabled
GetSimpleTableDispenser
InprocServer32FromString
OpenComponentLibraryEx
OpenComponentLibraryOnMemEx
OpenComponentLibraryOnStreamEx
ServerGetApplicationType
SetSetupOpen
SetSetupSave
SetupOpen
SetupSave
UpdateFromAppChange
UpdateFromComponentChange

Sections

.text
Size: 446KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d82d4d2327b8bd51f2ccea2054dde33a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-security-base-private-l1-1-0

api-ms-win-core-com-private-l1-1-0

rpcrt4

api-ms-win-core-version-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 446KB - Virtual size: 448KB

.data Size: 2KB - Virtual size: 16KB

.idata Size: 7KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 446KB - Virtual size: 448KB

.data
Size: 2KB - Virtual size: 16KB

.idata
Size: 7KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 22KB - Virtual size: 21KB