4d864e1ce7837ecd837a110110e900043cdf456a5cd8ca2130fbde4e60376f9a

Sharing

Copy URL Twitter E-mail

General

Target

4d864e1ce7837ecd837a110110e900043cdf456a5cd8ca2130fbde4e60376f9a
Size

640KB
MD5

6d02a21529198ea2e4db6d6f8159afa3
SHA1

29bf593c2280ce7b92959f0be10b23176dc12832
SHA256

4d864e1ce7837ecd837a110110e900043cdf456a5cd8ca2130fbde4e60376f9a
SHA512

d8cdb7e02af1b190c037790f7b4b167eb3700d2bd543d57b4117414ecb0f3ee608e2b6dff8489e7c1b79a9d8a5fe84f1789b4e3ee6e44a16a90bad09e9c637df
SSDEEP

12288:b3oDOnqcJSImUAuh//V+SJNbmIq0b78t/L0YkmnHCTKEVuOc2SzWYJ2WIh0qh8+y:b46nDsUAuh//V+SJNbmIq0b78t/L0Yka

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d864e1ce7837ecd837a110110e900043cdf456a5cd8ca2130fbde4e60376f9a

Files

4d864e1ce7837ecd837a110110e900043cdf456a5cd8ca2130fbde4e60376f9a
.dll regsvr32 windows:4 windows x64 arch:x64

341841c1e02096b935214ab423d85ccb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
GetDriveTypeW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersionExW
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryW
ResolveDelayLoadedAPI
RtlUnwind
SetFilePointerEx
SizeofResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
lstrcmpiW

ntdll

RtlIpv6AddressToStringExW
RtlIpv6StringToAddressW
_vsnprintf

ole32

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoMarshalInterface
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUnmarshalInterface
CreateBindCtx
CreateGenericComposite
CreateStreamOnHGlobal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
MkParseDisplayName
ReleaseStgMedium
STGMEDIUM_UserFree
STGMEDIUM_UserMarshal
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
StringFromCLSID

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConformantStringBufferSize
NdrConformantStringMarshall
NdrConformantStringUnmarshall
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConformantStructUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrSimpleTypeMarshall
NdrSimpleTypeUnmarshall
NdrStubGetBuffer
NdrStubInitialize
NdrUserMarshalBufferSize
NdrUserMarshalMarshall
NdrUserMarshalUnmarshall
RpcRaiseException

shell32

ShellExecuteExW

shlwapi

ord2
PathCreateFromUrlW
PathFindExtensionW
StrChrW
StrCmpNIW
StrCmpNW
UrlCanonicalizeW
UrlCombineW
UrlCompareW
UrlGetPartW
UrlUnescapeW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_strdup
_wcsdup
_wcsicmp
_wcsnicmp
calloc
free
fwrite
getenv
iswalpha
iswcntrl
iswspace
iswupper
malloc
memcmp
memcpy
memmove
memset
realloc
strchr
strcmp
strcspn
strlen
towlower
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcstol

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableWindow
EndDialog
GetDlgItem
GetPropW
KillTimer
LoadIconW
LoadStringW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
RegisterClassExW
RegisterClipboardFormatW
SendDlgItemMessageW
SetDlgItemTextW
SetPropW
SetTimer
TranslateMessage
UnregisterClassW
wsprintfW

wininet

CommitUrlCacheEntryW
CreateUrlCacheEntryW
FtpGetFileSize
HttpEndRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetErrorDlg
InternetLockRequestFile
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
InternetUnlockRequestFile
InternetWriteFile

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIUriPriv
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IEInstallScope
IsAsyncMoniker
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldShowIntranetWarningSecband
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 328KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 496B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

341841c1e02096b935214ab423d85ccb

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

ucrtbase

user32

wininet

Exports

Exports

Sections

.text Size: 328KB - Virtual size: 326KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 104KB - Virtual size: 103KB

/4 Size: 4KB - Virtual size: 48B

.pdata Size: 16KB - Virtual size: 13KB

.xdata Size: 16KB - Virtual size: 13KB

.bss Size: - Virtual size: 496B

.edata Size: 84KB - Virtual size: 83KB

.idata Size: 12KB - Virtual size: 10KB

.rsrc Size: 60KB - Virtual size: 57KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 328KB - Virtual size: 326KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 104KB - Virtual size: 103KB

/4
Size: 4KB - Virtual size: 48B

.pdata
Size: 16KB - Virtual size: 13KB

.xdata
Size: 16KB - Virtual size: 13KB

.bss
Size: - Virtual size: 496B

.edata
Size: 84KB - Virtual size: 83KB

.idata
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 60KB - Virtual size: 57KB

.reloc
Size: 4KB - Virtual size: 2KB