ceea6dab830e6f50b491316cd483956a08a694a6073b2e04fb8d3d149997c773

Sharing

Copy URL Twitter E-mail

General

Target

ceea6dab830e6f50b491316cd483956a08a694a6073b2e04fb8d3d149997c773
Size

1.7MB
MD5

550ee1d2f68557c61dbb2632afca19b2
SHA1

2da4d95d08c076810c13386f72823f2f137e8843
SHA256

ceea6dab830e6f50b491316cd483956a08a694a6073b2e04fb8d3d149997c773
SHA512

09d8f6f005385cbb6c56232265d833a8d1d70904bfa8dabbcf20ff4cd98376bbff0cdc27b25524f41279d7288cfff821ffccfea2a5a798f83fc25d9afbf2160c
SSDEEP

24576:HhAX+I1H3/JkucUfxDNye/Vz3QazTT7UHAm:BAXH3iub/V9TcL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceea6dab830e6f50b491316cd483956a08a694a6073b2e04fb8d3d149997c773

Files

ceea6dab830e6f50b491316cd483956a08a694a6073b2e04fb8d3d149997c773
.dll windows:6 windows x86

003d76ccb0ea97f292d643fbfa204cc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVolumeInformationA
CreateProcessA
LocalAlloc
LocalReAlloc
LocalFree
lstrcpyA
lstrcatA
lstrlenA
GetLogicalDriveStringsA
MoveFileA
OutputDebugStringA
CancelIo
InitializeCriticalSection
GetSystemInfo
GetVersionExA
GetProcAddress
LoadLibraryA
LocalSize
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
TerminateProcess
GetSystemDirectoryA
GetCurrentProcess
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WriteFile
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapQueryInformation
HeapSize
HeapReAlloc
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
GetDiskFreeSpaceExA
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
GetCurrentThread
ExitProcess
HeapValidate
QueryPerformanceFrequency
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
SetFilePointer
RemoveDirectoryA
ReadFile
GetFileSize
GetFileAttributesA
GetOEMCP
GetDriveTypeA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateFileA
CreateDirectoryA
GetTickCount
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
SetLastError
GetLastError
DecodePointer
VirtualFree
VirtualAlloc
ResumeThread
TerminateThread
CreateThread
Sleep
CreateEventA
WaitForSingleObject
SetEvent
LoadLibraryExW
CreateFileW
GetModuleFileNameW
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetModuleHandleW
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RaiseException
IsDebuggerPresent
GetCurrentThreadId
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
WideCharToMultiByte
EncodePointer
GetLocaleInfoEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
IsValidLocale
CloseHandle

user32

CreateWindowExA
GetClientRect
wsprintfA
CharNextA
GetSystemMetrics
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
keybd_event
mouse_event
MapVirtualKeyA
SetCapture
SetCursorPos
WindowFromPoint
BlockInput
GetDC
ReleaseDC
GetCursorPos
GetDesktopWindow
LoadCursorA
DestroyCursor
EnumDisplaySettingsA
GetCursorInfo
PostMessageA
ShowWindow
IsWindowVisible
GetWindowTextA
EnumWindows
SendMessageA
MoveWindow
DialogBoxParamA
EndDialog
SetDlgItemTextA
GetMessageA
SetFocus
TranslateMessage
DispatchMessageA
UnregisterClassA
SetTimer
LoadIconA
SystemParametersInfoA
KillTimer

gdi32

SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
CreateDIBSection

advapi32

EnumServicesStatusA
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
UnlockServiceDatabase
StartServiceA
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
LockServiceDatabase
RegCloseKey
ControlService
CloseServiceHandle
ChangeServiceConfigA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryValueA

shell32

SHGetFileInfoA

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString

winmm

waveInReset
PlaySoundA
waveInGetNumDevs
timeEndPeriod
waveOutGetNumDevs
waveOutOpen
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutReset
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInStop
timeBeginPeriod

ws2_32

WSAStartup
socket
WSACleanup
gethostbyname
closesocket
connect
htons
inet_addr
inet_ntoa
recv
select
WSAGetLastError
WSAIoctl
getsockname
gethostname
send
setsockopt

avicap32

capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICClose
ICOpen
ICCompressorFree
ICSeqCompressFrame

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

IsExit
IsStoped
StopRun
TestRun

Sections

.textbss
Size: - Virtual size: 655KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

003d76ccb0ea97f292d643fbfa204cc7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

ws2_32

avicap32

msvfw32

psapi

Exports

Exports

Sections

.textbss Size: - Virtual size: 655KB

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 274KB - Virtual size: 273KB

.data Size: 9KB - Virtual size: 31KB

.idata Size: 9KB - Virtual size: 9KB

.msvcjmc Size: 5KB - Virtual size: 5KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 30KB - Virtual size: 29KB

.reloc Size: 47KB - Virtual size: 46KB

.textbss
Size: - Virtual size: 655KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 274KB - Virtual size: 273KB

.data
Size: 9KB - Virtual size: 31KB

.idata
Size: 9KB - Virtual size: 9KB

.msvcjmc
Size: 5KB - Virtual size: 5KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 47KB - Virtual size: 46KB