ded42e37f05950374496824ce3f4d540a45e97be35ed6d7ddcfcf12a7b2cd46f

Sharing

Copy URL Twitter E-mail

General

Target

ded42e37f05950374496824ce3f4d540a45e97be35ed6d7ddcfcf12a7b2cd46f
Size

555KB
MD5

1fc97fdc9d87a4c6352d5dd1a27b2bea
SHA1

715dfdfa700dbeb34abcfee6944304ecb175e9c2
SHA256

ded42e37f05950374496824ce3f4d540a45e97be35ed6d7ddcfcf12a7b2cd46f
SHA512

927d6c62c09296064ab04bf75859f50dfb2318c1e8c23975fc531a7517dd27f0e4c8033e7c0cc82a650d125017e6c4c1e553b83ba9fe9e1f1050452fffd709a0
SSDEEP

12288:GUEX77u07IfK1WH3ezlcrgXypx32kPUtQl+IxOKB5Q0GyY6CWEZhbM0xck/JzNk3:pv6LcJRhWnyTKPwh+14b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ded42e37f05950374496824ce3f4d540a45e97be35ed6d7ddcfcf12a7b2cd46f

Files

ded42e37f05950374496824ce3f4d540a45e97be35ed6d7ddcfcf12a7b2cd46f
.dll regsvr32 windows:5 windows x64 arch:x64

4ac88e303106b907b893608841bb22ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
DeleteFileA
CloseHandle
GetSystemInfo
GetLocalTime
GetProcAddress
GetFileSize
ExitProcess
GetCurrentProcessId
GlobalMemoryStatusEx
WideCharToMultiByte
CreateFileA
GetComputerNameExA
GetDiskFreeSpaceExA
GetTickCount
GetComputerNameA
GetCurrentProcess
HeapSize
WriteConsoleW
SetStdHandle
GetProcessHeap
SetFileInformationByHandle
GetLastError
GetTickCount64
Sleep
MultiByteToWideChar
GetACP
GetModuleHandleA
CreateFileW
GetModuleFileNameW
OutputDebugStringA
GetModuleFileNameA
ReadFile
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetExitCodeThread
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
ExitThread
GetModuleHandleExW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetTimeZoneInformation
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
RtlUnwind

user32

EnumDisplaySettingsA
GetLastInputInfo
EnumDisplayDevicesA

advapi32

RegCloseKey
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
RegQueryValueExA
CryptDecrypt
RegOpenKeyExA
CryptSetKeyParam

crypt32

CryptStringToBinaryA

shlwapi

PathFileExistsW

Exports

Exports

DllRegisterServer

Sections

.text
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ac88e303106b907b893608841bb22ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

crypt32

shlwapi

Exports

Exports

Sections

.text Size: 364KB - Virtual size: 364KB

.rdata Size: 133KB - Virtual size: 133KB

.data Size: 30KB - Virtual size: 38KB

.pdata Size: 19KB - Virtual size: 19KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 364KB - Virtual size: 364KB

.rdata
Size: 133KB - Virtual size: 133KB

.data
Size: 30KB - Virtual size: 38KB

.pdata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB