b3483d90472684d1b9f367dfb05bffeb83dbc1f70fd182c0dd5632f9eacbeec4

Sharing

Copy URL Twitter E-mail

General

Target

b3483d90472684d1b9f367dfb05bffeb83dbc1f70fd182c0dd5632f9eacbeec4
Size

702KB
MD5

1371af26084bc8e1eb8e15349880446f
SHA1

95b276b6523bce623b5e1e659a27dc0a04cbc5f8
SHA256

b3483d90472684d1b9f367dfb05bffeb83dbc1f70fd182c0dd5632f9eacbeec4
SHA512

715b466d3609b1b5e4ec4c3266e742fad71cd9b04ca06457bbe0a6182d64278685c9cbb2c528757fb14fe0b6615f8264e33856315bd9f5e6d909cc63e66b174e
SSDEEP

12288:6cNQZIIz5osZDtlap9pCfIv1dwj2KVr8r2YhT89NAUUYXVynE:/0zNU0gv1S82PVsnE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3483d90472684d1b9f367dfb05bffeb83dbc1f70fd182c0dd5632f9eacbeec4

Files

b3483d90472684d1b9f367dfb05bffeb83dbc1f70fd182c0dd5632f9eacbeec4
.dll windows:6 windows x64 arch:x64

948962a3b73429241b5d7de0c7ed5eb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

crypt32

CryptProtectData

secur32

GetUserNameExW

user32

LoadStringA
LoadStringW

kernel32

GetDriveTypeW
GetDiskFreeSpaceExW
GetFileType
GetTapeStatus
GetTapeParameters
GetUserDefaultLCID
CreateSemaphoreW
InitializeCriticalSection
GetComputerNameExW
GetFileAttributesW
GetModuleFileNameW
CreatePipe
CreateProcessW
ReadFile
GetExitCodeProcess
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
GetSystemDirectoryW
DeleteFileW
SetLastError
CreateDirectoryW
LocalFileTimeToFileTime
CompareFileTime
OpenFileMappingW
SetEvent
OpenEventW
WaitForSingleObject
CreateEventW
Sleep
QueueUserWorkItem
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetNumberFormatW
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
SetFilePointer
GetConsoleOutputCP
PeekConsoleInputW
GetConsoleCP
GetStdHandle
GetTempPathW
SetEnvironmentVariableW
IsValidCodePage
OutputDebugStringW
GetCPInfo
GetLogicalDrives
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
GetFullPathNameW
GlobalReAlloc
GlobalFree
GlobalUnlock
GlobalFlags
GlobalAlloc
DebugBreak
WriteFile
GlobalLock
GetCurrentThread
GetCurrentProcess
GetEnvironmentVariableW
LoadLibraryW
FreeLibrary
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
FindClose
FindNextFileW
FileTimeToLocalFileTime
GetComputerNameW
MapViewOfFile
UnmapViewOfFile
GetSystemInfo
CreateFileMappingW
FileTimeToSystemTime
SystemTimeToFileTime
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetFileSize
FindFirstFileW
CreateFileW
CloseHandle
DecodePointer
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
LocalFree
GetLastError
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
lstrlenW
GetVersionExW
ResetEvent
SignalObjectAndWait
WaitForMultipleObjects
SearchPathW
ReleaseSemaphore
OpenSemaphoreW
GetTickCount
GetCurrentThreadId
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLangID
LoadLibraryExA
GetPrivateProfileStringW
CompareStringW
VirtualQuery

ole32

CoInitializeEx
CoInitialize
CoCreateInstance
CoGetMalloc
CLSIDFromString
CoUninitialize

advapi32

ChangeServiceConfigW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyW
LsaNtStatusToWinError
RegDeleteKeyW
RegEnumKeyExA
RegOpenKeyExA
RegConnectRegistryW
RegDeleteValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
QueryServiceConfigW
RegSetValueExW
UnlockServiceDatabase
CloseServiceHandle
RegCloseKey
OpenServiceW
LockServiceDatabase
OpenSCManagerW
FreeSid
EqualSid
AllocateAndInitializeSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
CryptExportKey
GetLengthSid
RegOpenKeyExW
IsValidSid
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl
LookupAccountNameW
InitializeSecurityDescriptor
RegQueryValueExW
GetTokenInformation
GetUserNameW
OpenThreadToken
OpenProcessToken
RegEnumValueW
RegEnumKeyExW
GetSecurityDescriptorDacl

Exports

Exports

R_GetXpVersion
Rp_availablemedia
Rp_create_subdir
Rp_delete_file
Rp_dirtree
Rp_dsninfo
Rp_enum_oledb_providers
Rp_enumdsn
Rp_enumerrorlogs
Rp_fileexist
Rp_fixeddrives
Rp_get_tape_devices
Rp_getnetname
Rp_instance_regaddmultistring
Rp_instance_regdeletekey
Rp_instance_regdeletevalue
Rp_instance_regenumkeys
Rp_instance_regenumvalues
Rp_instance_regread
Rp_instance_regremovemultistring
Rp_instance_regwrite
Rp_msx_enlist
Rp_passAgentInfo
Rp_prop_oledb_provider
Rp_readerrorlog
Rp_regaddmultistring
Rp_regdeletekey
Rp_regdeletevalue
Rp_regenumkeys
Rp_regenumvalues
Rp_regread
Rp_regremovemultistring
Rp_regwrite
Rp_servicecontrol
Rp_sqlagent_enum_jobs
Rp_sqlagent_is_starting
Rp_sqlagent_monitor
Rp_sqlagent_notify
Rp_sqlagent_param
Rp_sqlmaint
Rp_subdirs
Rp_sysmail_activate
Rp_sysmail_attachment_load
Rp_sysmail_format_query
T34

Sections

.text
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sdbid
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

948962a3b73429241b5d7de0c7ed5eb0

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

secur32

user32

kernel32

ole32

advapi32

Exports

Exports

Sections

.text Size: 292KB - Virtual size: 292KB

.rdata Size: 83KB - Virtual size: 83KB

.data Size: 3KB - Virtual size: 10KB

.pdata Size: 12KB - Virtual size: 11KB

.sdbid Size: 1KB - Virtual size: 1KB

.rsrc Size: 292KB - Virtual size: 289KB

.reloc Size: 1024B - Virtual size: 904B

.text
Size: 292KB - Virtual size: 292KB

.rdata
Size: 83KB - Virtual size: 83KB

.data
Size: 3KB - Virtual size: 10KB

.pdata
Size: 12KB - Virtual size: 11KB

.sdbid
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 292KB - Virtual size: 289KB

.reloc
Size: 1024B - Virtual size: 904B