a4d4b3bcabf37ea181dfb4f00d861735cba8963ec8a170956e29889c54b70679

Sharing

Copy URL Twitter E-mail

General

Target

a4d4b3bcabf37ea181dfb4f00d861735cba8963ec8a170956e29889c54b70679
Size

3.6MB
MD5

ffd317cf6b50b38ad2d98a0404e9e3ac
SHA1

e035f684bab7c6d192c3f221a1662c147ac172fe
SHA256

a4d4b3bcabf37ea181dfb4f00d861735cba8963ec8a170956e29889c54b70679
SHA512

0aa1f9fe25d70bd74b46bb80c10336af5a266f8d09fb1bcfb273d4dcbac27fd6b003aa4ed4dd7921d7cf9ef173d40e84b08389b72a5ad5e6b71f6c62ac773259
SSDEEP

49152:qMTvfhHS/dvRCEPD77Muj1MtCNFOE8f6RjuNvXx/dSPfUP4f8GT4hVor:qMTv67Pj9etCNFO0juNvXJdEUP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4d4b3bcabf37ea181dfb4f00d861735cba8963ec8a170956e29889c54b70679

Files

a4d4b3bcabf37ea181dfb4f00d861735cba8963ec8a170956e29889c54b70679
.dll windows:6 windows x86 arch:x86

abca246cf860ad413472f0eac4b15ac1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind
RtlInitUnicodeString
ZwQueryInformationFile
NtCreateFile
NtQuerySystemInformation

shlwapi

PathCanonicalizeA

imagehlp

SymCleanup
SymInitialize

kernel32

CreateFileMappingA
WaitForSingleObject
CreateThread
OpenThread
TerminateThread
GetExitCodeThread
GetThreadContext
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
Thread32First
Thread32Next
LeaveCriticalSection
FreeLibrary
CreateDirectoryA
GetFileAttributesA
GetFullPathNameA
GetWindowsDirectoryA
GetCurrentDirectoryA
GetLogicalDrives
GetLongPathNameA
UnmapViewOfFile
K32QueryWorkingSet
K32EnumProcessModules
TerminateProcess
GetProcessId
GetStdHandle
FlushConsoleInputBuffer
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetEnvironmentVariableA
GetSystemTimeAsFileTime
ReadFile
WriteFile
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtectEx
EnterCriticalSection
InitializeCriticalSection
K32GetProcessImageFileNameA
IsBadReadPtr
GetTickCount
ExpandEnvironmentStringsA
OpenProcess
GetCurrentProcess
SetLastError
MapViewOfFile
ReadProcessMemory
GetFileSize
CreateFileA
K32GetMappedFileNameA
K32GetModuleFileNameExA
VirtualQueryEx
QueryDosDeviceA
DeleteCriticalSection
GetLastError
CloseHandle
GetTempPathA
GetCurrentThread
HeapSize
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEndOfFile
SetStdHandle
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
CreateDirectoryW
GetTimeZoneInformation
DeleteFileW
SetFilePointerEx
GetConsoleOutputCP
FormatMessageA
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
LocalFree
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetModuleHandleW
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
ReleaseMutex
CreateMutexA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetFileSizeEx
GetSystemInfo
GetFileType
SwitchToThread
GetModuleHandleExW
FormatMessageW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetProcessHeap
IsWow64Process
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetModuleFileNameW
WriteConsoleW
CreateFileW
SetConsoleCtrlHandler
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
LookupPrivilegeValueA
ImpersonateSelf
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
CryptReleaseContext
DeregisterEventSource

crypt32

CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty

ws2_32

connect
closesocket
bind
accept
WSASetLastError
listen
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
getsockname
setsockopt
socket
ioctlsocket
send
ntohs
getsockopt
gethostbyname

bcrypt

BCryptGenRandom

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

Exports

Exports

GetModuleHandle64
GetProcAddress64
GetThreadContext64
PESieve_file_scan
PESieve_filescan_init
PESieve_filescan_init2
PESieve_lib_init
PESieve_memory_scan
PESieve_memscan_init
PESieve_memscan_init2
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call
ZydisCalcAbsoluteAddress
ZydisCalcAbsoluteAddressEx
ZydisCategoryGetString
ZydisDecoderDecodeFull
ZydisDecoderDecodeInstruction
ZydisDecoderDecodeOperands
ZydisDecoderEnableMode
ZydisDecoderInit
ZydisDisassembleATT
ZydisDisassembleIntel
ZydisEncoderDecodedInstructionToEncoderRequest
ZydisEncoderEncodeInstruction
ZydisEncoderEncodeInstructionAbsolute
ZydisEncoderNopFill
ZydisFormatterBufferAppend
ZydisFormatterBufferGetString
ZydisFormatterBufferGetToken
ZydisFormatterBufferRemember
ZydisFormatterBufferRestore
ZydisFormatterFormatInstruction
ZydisFormatterFormatOperand
ZydisFormatterInit
ZydisFormatterSetHook
ZydisFormatterSetProperty
ZydisFormatterTokenGetValue
ZydisFormatterTokenNext
ZydisFormatterTokenizeInstruction
ZydisFormatterTokenizeOperand
ZydisGetInstructionSegments
ZydisGetVersion
ZydisISAExtGetString
ZydisISASetGetString
ZydisIsFeatureEnabled
ZydisMnemonicGetString
ZydisMnemonicGetStringWrapped
ZydisRegisterClassGetWidth
ZydisRegisterEncode
ZydisRegisterGetClass
ZydisRegisterGetId
ZydisRegisterGetLargestEnclosing
ZydisRegisterGetString
ZydisRegisterGetStringWrapped
ZydisRegisterGetWidth
_DllMain_wow64ext@12

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 994KB - Virtual size: 993KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abca246cf860ad413472f0eac4b15ac1

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

imagehlp

kernel32

advapi32

crypt32

ws2_32

bcrypt

user32

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 994KB - Virtual size: 993KB

.data Size: 86KB - Virtual size: 107KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 110KB - Virtual size: 109KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 994KB - Virtual size: 993KB

.data
Size: 86KB - Virtual size: 107KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 110KB - Virtual size: 109KB