9740dd9dd09ed7c9caff6cb7f889466386ae6a94b6a10dda09343703b5658aa7

Sharing

Copy URL Twitter E-mail

General

Target

9740dd9dd09ed7c9caff6cb7f889466386ae6a94b6a10dda09343703b5658aa7
Size

1.1MB
MD5

36d9de2d2d88c5f672da70f20c04a616
SHA1

bec7cdff4a6a7a1b27f9a0fc63e9d0b7486a90b2
SHA256

9740dd9dd09ed7c9caff6cb7f889466386ae6a94b6a10dda09343703b5658aa7
SHA512

f81abc5f07b5e1b82dd6d9c56f65319435e02885893e9cf613c4da2e378add5f5d65730a7872ee120a551349c4ead2b45cc7c7c02f16c6629e42d3336edb9e6c
SSDEEP

12288:gZRsX86wh9xtqC5hYwe1G6TnMhgueyG2N9L9P/sSl:cHOC5+we1GsnMfP/B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9740dd9dd09ed7c9caff6cb7f889466386ae6a94b6a10dda09343703b5658aa7

Files

9740dd9dd09ed7c9caff6cb7f889466386ae6a94b6a10dda09343703b5658aa7
.exe windows:6 windows x64 arch:x64

d613e105c0e41bb3a40199c7ec90a9db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
ExitProcess
GetModuleHandleW
FreeLibrary
CopyFileW
lstrcmpiW
LoadLibraryExW
GetFullPathNameW
WaitForSingleObject
ReadFile
GetFileInformationByHandleEx
HeapFree
GetCurrentProcess
WriteFile
CreateFileW
CreateEventW
SetFileInformationByHandle
HeapAlloc
GetOverlappedResult
SetFilePointerEx
GetProcessHeap
QueryPerformanceCounter
WideCharToMultiByte
LoadResource
CloseHandle
InterlockedFlushSList
FormatMessageW
OutputDebugStringW
SetCurrentDirectoryW
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LCMapStringEx
EncodePointer
CompareStringEx
GetStringTypeW
WaitForSingleObjectEx
MultiByteToWideChar
GetCommandLineW
SizeofResource
CreateDirectoryW
MulDiv
lstrcmpW
LoadLibraryExA
GlobalUnlock
SleepEx
DeleteCriticalSection
GlobalLock
DecodePointer
RaiseException
GlobalAlloc
GetLastError
GetTickCount64
GetCurrentThreadId
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
SetLastError
FindResourceW
LocalFree

user32

GetMessageW
DispatchMessageW
PeekMessageW
TranslateMessage
UpdateWindow
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
CallWindowProcW
PostMessageW
GetWindow
GetWindowRect
GetFocus
GetDC
SetWindowPos
GetDpiForWindow
GetPropW
MonitorFromWindow
SetWindowLongPtrW
FillRect
CreateWindowExW
GetAncestor
SetForegroundWindow
RemoveMenu
SetActiveWindow
GetSystemMenu
DestroyWindow
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
SetWindowTextW
LoadImageW
ReleaseCapture
RegisterWindowMessageW
GetParent
GetClassInfoExW
EnumDisplaySettingsW
GetDesktopWindow
PostQuitMessage
ScreenToClient
SendMessageW
UnregisterClassW
GetWindowLongPtrW
RegisterClassExW
ShowWindow
IsWindow
InvalidateRgn
SetTimer
RedrawWindow
RemovePropW
KillTimer
GetDlgItem
IsZoomed
GetClientRect
SetWindowLongW
SetCapture
GetClassNameW
LoadCursorW
CharNextW
SetFocus
CreateAcceleratorTableW
MoveWindow
GetSysColor
IsChild
DestroyAcceleratorTable
ClientToScreen
GetMonitorInfoW
DestroyIcon
SetPropW
EnableWindow
InvalidateRect

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

advapi32

RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
GetTokenInformation
QueryServiceStatusEx
OpenServiceW
StartServiceW
OpenProcessToken
OpenSCManagerW
CloseServiceHandle
RegOpenKeyExW
RegDeleteValueW

shell32

SHOpenWithDialog
SHGetKnownFolderPath
SetCurrentProcessExplicitAppUserModelID
ShellExecuteExW

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
OleInitialize
CoGetClassObject
CoTaskMemFree
CoCreateGuid
CoCreateFreeThreadedMarshaler
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleUninitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

SysStringLen
SysAllocString
OleCreateFontIndirect
SysFreeString
SysAllocStringLen
VariantInit
LoadRegTypeLi
VarUI4FromStr
SetErrorInfo
LoadTypeLi
VariantClear
GetErrorInfo

computecore

HcsCreateEmptyRuntimeStateFile
HcsSaveComputeSystem
HcsPauseComputeSystem
HcsModifyComputeSystem
HcsCreateOperation
HcsStartComputeSystem
HcsTerminateComputeSystem
HcsGetComputeSystemProperties
HcsCloseOperation
HcsGrantVmAccess
HcsCreateEmptyGuestStateFile
HcsGetServiceProperties
HcsWaitForOperationResult
HcsCreateComputeSystem
HcsCloseComputeSystem
HcsSetComputeSystemCallback
HcsResumeComputeSystem

computenetwork

HcnDeleteEndpoint
HcnQueryEndpointProperties
HcnCreateEndpoint
HcnOpenNetwork
HcnCloseNetwork
HcnCloseEndpoint

shlwapi

PathFileExistsW

uxtheme

SetWindowThemeAttribute

dwmapi

DwmSetWindowAttribute
DwmGetWindowAttribute
DwmExtendFrameIntoClientArea

virtdisk

CreateVirtualDisk

ucrtbase

wcsncpy_s
wcstoull
realloc
_wcsnicmp
_beginthreadex
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
wcstol
___lc_locale_name_func
_lock_locales
_unlock_locales
setlocale
__pctype_func
___lc_codepage_func
calloc
_wcsdup
___lc_collate_cp_func
___mb_cur_max_func
wcsnlen
free
_dclass
_callnewh
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
exit
_exit
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_stricmp
_recalloc
__stdio_common_vswprintf_s
strtoull
__stdio_common_vsprintf
localeconv
strtoll
strtod
_dsign
toupper
_invalid_parameter_noinfo_noreturn
_errno
_invalid_parameter_noinfo
abort
__std_type_info_destroy_list
__C_specific_handler
__current_exception_context
__current_exception
malloc
memset
memmove
memcmp
memcpy
_CxxThrowException
strchr
wcsrchr
wcsstr
__std_terminate
_purecall
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler4
iswspace

Exports

Exports

DllGetActivationFactory
VSDesignerCanUnloadNow
VSDesignerDllMain

Sections

.text
Size: 449KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d613e105c0e41bb3a40199c7ec90a9db

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

computecore

computenetwork

shlwapi

uxtheme

dwmapi

virtdisk

ucrtbase

Exports

Exports

Sections

.text Size: 449KB - Virtual size: 448KB

.rdata Size: 353KB - Virtual size: 353KB

.data Size: 199KB - Virtual size: 203KB

.pdata Size: 23KB - Virtual size: 22KB

.rsrc Size: 83KB - Virtual size: 82KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 449KB - Virtual size: 448KB

.rdata
Size: 353KB - Virtual size: 353KB

.data
Size: 199KB - Virtual size: 203KB

.pdata
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 83KB - Virtual size: 82KB

.reloc
Size: 8KB - Virtual size: 8KB