d7ecd2338e312bcfdf6df2e436a004f0ac0941e965927e4f6eb3774b09ca6b37

Sharing

Copy URL Twitter E-mail

General

Target

d7ecd2338e312bcfdf6df2e436a004f0ac0941e965927e4f6eb3774b09ca6b37
Size

3.4MB
MD5

582e3610ccdf61e7465abf9be88c3d78
SHA1

8ff6dd3bf3961529e2bbe8a48c3fa20db084e956
SHA256

d7ecd2338e312bcfdf6df2e436a004f0ac0941e965927e4f6eb3774b09ca6b37
SHA512

9bfec40cd80eeef454da9d19419c07e96580589a839ace297c5f8b066c44bfd3be2c564e85dce83b9dc4a3d94359d23aeccb9189689dc120059cbe55c133838a
SSDEEP

49152:xHHKI4KkuE1+YmNKZlPwxicKVJnpRJUlgd+izwPUdvGY33ffUaI9:xHHn4pN1jmSnDJUle+Et

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7ecd2338e312bcfdf6df2e436a004f0ac0941e965927e4f6eb3774b09ca6b37

Files

d7ecd2338e312bcfdf6df2e436a004f0ac0941e965927e4f6eb3774b09ca6b37
.dll regsvr32 windows:6 windows x86 arch:x86

3494a866b7fdb9a26eeacdcd54d84891

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

setsockopt
listen
connect
closesocket
bind
accept
send
recv
WSASetLastError
getservbyname
getservbyport
socket
inet_ntoa
inet_addr
htons
htonl
WSAGetLastError
gethostbyname
ntohs
getsockopt
getsockname
ioctlsocket
select
gethostbyaddr
gethostname
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
__WSAFDIsSet
WSAIoctl
inet_pton
inet_ntop
WSASetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSACleanup
shutdown
WSAStartup

kernel32

PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageA
GetCurrentThreadId
GetTickCount
VerSetConditionMask
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
CreateWaitableTimerW
QueueUserAPC
TerminateThread
VerifyVersionInfoW
GetStdHandle
CreateDirectoryW
WriteFile
GetCurrentProcessId
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
QueryPerformanceFrequency
InitializeCriticalSectionEx
SystemTimeToFileTime
GetSystemTime
ConvertThreadToFiberEx
ConvertFiberToThread
ReadConsoleW
ReadConsoleA
SetConsoleMode
CreateFiberEx
DeleteFiber
SwitchToFiber
GetACP
GetFileType
GetEnvironmentVariableW
GetModuleHandleExW
VirtualFree
Sleep
LocalFree
GetCurrentProcess
CreateProcessW
TerminateProcess
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
FormatMessageW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetProcessHeap
HeapSize
GetModuleHandleA
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
GetSystemDirectoryW
GetTimeZoneInformation
InitOnceBeginInitialize
InitOnceComplete
IsDebuggerPresent
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LoadLibraryA
GetSystemDirectoryA
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
ReadFile
GetFileSizeEx
SetFilePointer
GetFileSize
CreateFileW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
CopyFileW
DeleteFileW
CreateThread

user32

DispatchMessageW
PostMessageW
GetMessageW
TranslateMessage
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
SetWindowLongW
GetWindowLongW
KillTimer
SetTimer
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW

shell32

ord165

ole32

CoUninitialize
CoInitialize

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptReleaseContext
CryptHashData
CryptGetHashParam

msvcp140

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Xtime_get_ticks
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Thrd_detach
_Query_perf_frequency
_Query_perf_counter
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??Bid@locale@std@@QAEIXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Xbad_alloc@std@@YAXXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
_Mtx_lock

shlwapi

PathFindFileNameW
PathCanonicalizeW
PathAddBackslashW
PathRemoveFileSpecW
PathIsRelativeW
PathFileExistsW
PathAppendW
PathQuoteSpacesW

vcruntime140

__current_exception_context
__std_type_info_destroy_list
__current_exception
_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
memchr
__std_type_info_compare
wcsstr
wcschr
strstr
strrchr
strchr
memset
memcpy
__CxxFrameHandler3
memmove

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
__sys_nerr
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_beginthreadex
raise
_exit
terminate
signal
strerror_s
_wassert
abort
_errno
_seh_filter_dll
_configure_narrow_argv
__sys_errlist

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
realloc
malloc
_recalloc

api-ms-win-crt-convert-l1-1-0

strtol
wcstombs
_ecvt_s
_wtoi
wcstod
strtoll
atoi
strtoul

api-ms-win-crt-string-l1-1-0

_strdup
isdigit
tolower
_wcsdup
strcmp
strcspn
strspn
wcscspn
strncpy
wcsspn
strncpy_s
wcsncpy
wmemcpy_s
wcsncat
strcpy_s
strcat_s
isspace
strpbrk
strnlen
strncmp
wcspbrk
wcsncmp
wcsnlen

api-ms-win-crt-stdio-l1-1-0

fwrite
_fseeki64
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
_close
fread
fputc
feof
ferror
fgets
setvbuf
fseek
ftell
_setmode
_write
_read
__stdio_common_vsscanf
_lseeki64
_wfopen
fopen
fflush
fclose
_fileno
fputs
__stdio_common_vsnprintf_s
__acrt_iob_func
__stdio_common_vfprintf
_wopen

api-ms-win-crt-math-l1-1-0

ceil
_fdopen
_dsign
_fdsign
_finite
_isnan
_CIfmod
_dclass
_fdclass
_ldclass
floor
_ldsign

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64_s
_time64
_gmtime64
_localtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv

crypt32

CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
PFXImportCertStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptStringToBinaryW

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_waccess
_wstat64
_unlink
_fstat64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

bcrypt

BCryptGenRandom

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 692KB - Virtual size: 691KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3494a866b7fdb9a26eeacdcd54d84891

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

shell32

ole32

advapi32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

crypt32

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

bcrypt

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 692KB - Virtual size: 691KB

.data Size: 35KB - Virtual size: 51KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 127KB - Virtual size: 126KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 692KB - Virtual size: 691KB

.data
Size: 35KB - Virtual size: 51KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 127KB - Virtual size: 126KB