c657c7d749ff7bceabd77395ca56e264e2cb7bff90b025af171f8baca5084914

Sharing

Copy URL

Twitter E-mail

General

Target

c657c7d749ff7bceabd77395ca56e264e2cb7bff90b025af171f8baca5084914
Size

1002KB
MD5

9fbf4989ac434e1aee2c8406347c2569
SHA1

8d29476d773e9a74106ea793cc2c9aec6ed6253c
SHA256

c657c7d749ff7bceabd77395ca56e264e2cb7bff90b025af171f8baca5084914
SHA512

b49aca257c7caa6dff693c52869f6a2a2e785dae5e1891bf5305f18382d75c6bb47647f7addf907512581321713f881235d99b0de252e7705ed0fadcb489e9b3
SSDEEP

24576:UHpwutksPoFZj2t006veH35an0aT8InBSHbMNUaTnnpHntC0:otFPojs6vn0G8IBS7MNUaTBtC0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c657c7d749ff7bceabd77395ca56e264e2cb7bff90b025af171f8baca5084914

Files

c657c7d749ff7bceabd77395ca56e264e2cb7bff90b025af171f8baca5084914
.dll windows:6 windows x86 arch:x86

4c59b2191f2692843ca0c247fac10d9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetCurrentProcessId
CreateThread
OpenProcess
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameA
GetModuleHandleExA
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
CreateFileA
ReadFile
SetFilePointer
GetCurrentThread
CreateDirectoryA
CloseHandle
LoadResource
LockResource
SizeofResource
LocalAlloc
LocalFree
FindResourceA
GetProcAddress
SetEndOfFile
HeapSize
WriteConsoleW
CreateFileW
SetStdHandle
GetCommandLineW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLongPathNameA
AllocConsole
GetCommandLineA
LoadLibraryA
FreeConsole
GetCurrentProcess
IsDebuggerPresent
FreeResource
GetFullPathNameA
GetOEMCP
IsValidCodePage
GetProcessHeap
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
FreeLibrary
LoadLibraryExA
LoadLibraryExW
FormatMessageA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
GetVersionExW
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RaiseException
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DeleteFileW
ReadConsoleW
GetTimeZoneInformation

user32

GetWindowRect
SetWindowRgn
GetCursorPos
GetWindowThreadProcessId
SetWindowLongA
MessageBoxA
GetClientRect
SetWindowTextA
BringWindowToTop
SendMessageA
UnpackDDElParam

gdi32

CombineRgn
CreateRectRgn

comdlg32

GetSaveFileNameA

advapi32

AdjustTokenPrivileges
OpenProcessToken
SystemFunction036
LookupPrivilegeValueA

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

AddFileToCompress
AddFileToCompressWithFilename
BindChrome
BindChromeEasy
LoadURL
PJ_APP
PJ_Call
PJ_Call_String
PopWeb
Ptr2Str
Resize
Str2Ptr
console_log
convert
dw_event
execScript
hookGetSaveFileNameAOnce
luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_closeslot
lua_compare
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resetthread
lua_resume
lua_rotate
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_toclose
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_xmove
lua_yieldk
luaopen_base
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8
pack_pbls
pb_cancel
pb_retrieve
regex_match
regex_replace
regex_search
sendClicked
sendProcessMsg
sendWebClick
sendWebMsg
setPbapi
testPbFuction

Sections

.text
Size: 656KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c59b2191f2692843ca0c247fac10d9c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

psapi

Exports

Exports

Sections

.text Size: 656KB - Virtual size: 656KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 9KB - Virtual size: 16KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 127KB - Virtual size: 126KB

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 656KB - Virtual size: 656KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 9KB - Virtual size: 16KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 127KB - Virtual size: 126KB

.reloc
Size: 42KB - Virtual size: 42KB