28ee86e831e9cd495798dd6ea8b59a7de5670e8bbca71eaf42d5e983c84d8e95

Sharing

Copy URL Twitter E-mail

General

Target

28ee86e831e9cd495798dd6ea8b59a7de5670e8bbca71eaf42d5e983c84d8e95
Size

715KB
MD5

f8247c7d30200f781317453d424e07c7
SHA1

4cbd03e58ffb1f4acf6d64ea3705663d6ac2442a
SHA256

28ee86e831e9cd495798dd6ea8b59a7de5670e8bbca71eaf42d5e983c84d8e95
SHA512

20e09fe0bcc42caaf55864773319a0cc5c191b00e8c0a7c9c2cd99b02e8fa0b9db78d26ad48660612caec2e9704c8e05aced0fea68d9b1a3e2a63af82a435465
SSDEEP

12288:S2TtGlYBpW1M3Ciz92oJ4WhiqhLMTATfGeXkzf:ZtqYBEKSimKFXXof

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28ee86e831e9cd495798dd6ea8b59a7de5670e8bbca71eaf42d5e983c84d8e95

Files

28ee86e831e9cd495798dd6ea8b59a7de5670e8bbca71eaf42d5e983c84d8e95
.dll regsvr32 windows:4 windows x86 arch:x86

25ca371431e5f63be42254cb47f67de2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
GetDriveTypeW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersionExW
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryW
ResolveDelayLoadedAPI
RtlUnwind
SetFilePointerEx
SizeofResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
lstrcmpiW

ntdll

RtlIpv6AddressToStringExW
RtlIpv6StringToAddressW
_vsnprintf

ole32

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoMarshalInterface
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUnmarshalInterface
CreateBindCtx
CreateGenericComposite
CreateStreamOnHGlobal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
MkParseDisplayName
ReleaseStgMedium
STGMEDIUM_UserFree
STGMEDIUM_UserMarshal
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
StringFromCLSID

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConformantStringBufferSize
NdrConformantStringMarshall
NdrConformantStringUnmarshall
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConformantStructUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrSimpleTypeMarshall
NdrSimpleTypeUnmarshall
NdrStubGetBuffer
NdrStubInitialize
NdrUserMarshalBufferSize
NdrUserMarshalMarshall
NdrUserMarshalUnmarshall
RpcRaiseException

shell32

ShellExecuteExW

shlwapi

ord2
PathCreateFromUrlW
PathFindExtensionW
StrChrW
StrCmpNIW
StrCmpNW
UrlCanonicalizeW
UrlCombineW
UrlCompareW
UrlGetPartW
UrlUnescapeW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_recalloc
_strdup
_wcsdup
_wcsicmp
_wcsnicmp
calloc
free
fwrite
getenv
iswalpha
iswcntrl
iswspace
iswupper
malloc
memcmp
memcpy
memmove
memset
realloc
strchr
strcmp
strcspn
strlen
towlower
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcstol

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableWindow
EndDialog
GetDlgItem
GetPropW
KillTimer
LoadIconW
LoadStringW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
RegisterClassExW
RegisterClipboardFormatW
SendDlgItemMessageW
SetDlgItemTextW
SetPropW
SetTimer
TranslateMessage
UnregisterClassW
wsprintfW

wininet

CommitUrlCacheEntryW
CreateUrlCacheEntryW
FtpGetFileSize
HttpEndRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetErrorDlg
InternetLockRequestFile
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
InternetUnlockRequestFile
InternetWriteFile

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIUriPriv
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IEInstallScope
IsAsyncMoniker
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldShowIntranetWarningSecband
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 352KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 228B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25ca371431e5f63be42254cb47f67de2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

ucrtbase

user32

wininet

Exports

Exports

Sections

.text Size: 352KB - Virtual size: 350KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 92KB - Virtual size: 89KB

/4 Size: 64KB - Virtual size: 62KB

.bss Size: - Virtual size: 228B

.edata Size: 88KB - Virtual size: 84KB

.idata Size: 12KB - Virtual size: 8KB

.rsrc Size: 60KB - Virtual size: 57KB

.reloc Size: 24KB - Virtual size: 20KB

.text
Size: 352KB - Virtual size: 350KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 92KB - Virtual size: 89KB

/4
Size: 64KB - Virtual size: 62KB

.bss
Size: - Virtual size: 228B

.edata
Size: 88KB - Virtual size: 84KB

.idata
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 60KB - Virtual size: 57KB

.reloc
Size: 24KB - Virtual size: 20KB