4765d8631ac945738427b3faf72e3256

Sharing

Copy URL Twitter E-mail

General

Target

4765d8631ac945738427b3faf72e3256
Size

2.5MB
MD5

4765d8631ac945738427b3faf72e3256
SHA1

0eb923ae761823fec5fa2c04b2779abf94fa1a2a
SHA256

6364e213f6d008499e741e095ddcd4d4c4ec8a5c923aaa7f8ffeae7be62a0922
SHA512

524f15c47860a5a8837b554c6555c4da159da39344906802d2afb88183051658fe5347eadfe556843e52d17bd0e8f6e06d2da662f04e6d367e95762b7b11ac6e
SSDEEP

49152:EsYRsT65W0aAy4QPmNzJVfWgQYaeOVLHebZSkfAIf:wR7aALQu5JVfWghyL+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4765d8631ac945738427b3faf72e3256

Files

4765d8631ac945738427b3faf72e3256
.dll windows:4 windows x86 arch:x86

ceb2221d2faac1a3d7c9be9f9d21cbe6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
WriteFile
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
VirtualProtect
GetSystemInfo
VirtualQuery
CreateFileA
FlushFileBuffers
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
OpenProcess
TerminateThread
WaitForMultipleObjects
GlobalLock
GlobalUnlock
GetEnvironmentVariableW
CreateProcessW
GetLogicalDrives
GetDriveTypeA
CreateFileW
GetTempPathW
InterlockedExchangeAdd
GetVersion
ConnectNamedPipe
CreateNamedPipeW
ReadFile
GetComputerNameA
CreateProcessA
LocalFree
ExpandEnvironmentStringsA
FindClose
FindNextFileA
CreateDirectoryA
FindFirstFileA
CopyFileA
GetFileTime
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
FreeEnvironmentStringsA
FileTimeToSystemTime
FileTimeToLocalFileTime
LoadLibraryExW
lstrcmpA
SetEndOfFile
GetFileSize
GetSystemTimeAsFileTime
GetTempPathA
LocalAlloc
GetEnvironmentVariableA
Process32Next
Process32First
CreateToolhelp32Snapshot
ReleaseMutex
CreateMutexA
VirtualFreeEx
CreateRemoteThread
VirtualFree
VirtualAllocEx
Thread32Next
SuspendThread
OpenThread
Thread32First
InterlockedCompareExchange
GetProcessId
GetSystemDirectoryA
FormatMessageA
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
CreateDirectoryW
GetFileAttributesW
SetFileTime
SetThreadPriority
InitializeCriticalSectionAndSpinCount
GetProcessAffinityMask
FindFirstFileW
FindNextFileW
GetTempFileNameW
CreateFileMappingW
ExpandEnvironmentStringsW
SetThreadContext
GetThreadContext
ResumeThread
GetFullPathNameW
GetFullPathNameA
CreateMutexW
HeapCompact
TryEnterCriticalSection
UnlockFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
LoadLibraryW
FormatMessageW
GetVersionExW
GetFileAttributesA
HeapValidate
HeapSize
LockFileEx
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFileAttributesExW
DeleteFileW
GetSystemTime
AreFileApisANSI
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
GetCurrentThreadId
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
HeapCreate
GetLocalTime
CreateWaitableTimerA
SetWaitableTimer
RemoveDirectoryA
GlobalAlloc
QueueUserAPC
SleepEx
ResetEvent
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
RaiseException
GetCurrentProcessId
GetTempFileNameA
QueryPerformanceCounter
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
GetModuleHandleA
GetProcAddress
GetVersionExA
GetCommandLineA
CreateSemaphoreA
DeleteFileA
CreateEventA
GetTickCount
MoveFileA
MoveFileExA
CreateThread
ReleaseSemaphore
GetLastError
GetProcessHeap
HeapFree
Sleep
ExitThread
WaitForSingleObject
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
WriteProcessMemory
GetEnvironmentStrings
GetCurrentProcess
GetCurrentThread
DuplicateHandle
lstrlenA
OpenEventA
SetEvent
UnmapViewOfFile
CloseHandle

user32

OemToCharA
wsprintfW
ReleaseDC
GetWindowInfo
FillRect
SendMessageA
GetMenu
GetMenuItemCount
GetMenuState
HiliteMenuItem
MenuItemFromPoint
EndMenu
GetSubMenu
GetMenuItemRect
TrackPopupMenuEx
GetMenuItemID
SendMessageW
WindowFromPoint
GetAncestor
ToUnicodeEx
UnhookWindowsHookEx
OpenClipboard
DispatchMessageA
SetWindowsHookExA
GetClassNameW
GetWindowTextW
GetClipboardData
GetKeyboardLayout
GetGUIThreadInfo
GetForegroundWindow
TranslateMessage
SetWindowPos
GetWindowRect
PtInRect
GetShellWindow
GetWindowTextA
MapVirtualKeyA
PostMessageA
GetThreadDesktop
CreateDesktopA
SetThreadDesktop
EnumChildWindows
OpenDesktopA
EnumDesktopWindows
VkKeyScanW
PostMessageW
EmptyClipboard
CloseDesktop
DrawIcon
GetIconInfo
GetDC
GetCursorInfo
GetDesktopWindow
GetCursorPos
SystemParametersInfoA
ExitWindowsEx
GetMessageA
CloseClipboard
PostThreadMessageA
GetKeyState
CallNextHookEx
GetSystemMetrics
EnumWindows
IsWindowVisible
GetWindow
GetTopWindow
GetWindowLongA
GetClassNameA
SetClipboardData
GetWindowThreadProcessId

gdi32

CreateDIBSection
DeleteObject
SelectObject
CreateCompatibleDC
BitBlt
DeleteDC

advapi32

GetTokenInformation
GetUserNameW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegDeleteValueW
RegCreateKeyW
GetSidSubAuthority
GetSidSubAuthorityCount
RegSetValueExA
RegEnumValueA
RegDeleteValueA
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyA
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
GetUserNameA
SetSecurityInfo
GetSecurityInfo
CredFree
CredEnumerateA
CredReadA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenThreadToken
ImpersonateSelf
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegEnumKeyW

shell32

ShellExecuteExW
ShellExecuteExA
SHGetFolderPathA
ShellExecuteA
SHGetFolderPathW

ole32

CoGetObject
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

ntdll

ZwQuerySystemInformation

wininet

InternetCrackUrlA
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetQueryDataAvailable
InternetConnectA
InternetGetConnectedState

rpcrt4

UuidToStringA
UuidCreate

iphlpapi

GetIfTable
GetAdaptersAddresses

ws2_32

WSAStartup
WSACleanup
ntohl
ntohs
WSAAddressToStringA
WSASetLastError
WSAGetLastError
WSASend
select
__WSAFDIsSet
WSARecv
htonl
htons
ioctlsocket
closesocket
listen
setsockopt
WSASocketA
getaddrinfo
freeaddrinfo
bind
getsockopt
getpeername
getsockname
connect
inet_addr
accept

mpr

WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum

secur32

DeleteSecurityContext
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleA

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 340KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ceb2221d2faac1a3d7c9be9f9d21cbe6

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ntdll

wininet

rpcrt4

iphlpapi

ws2_32

mpr

secur32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 340KB - Virtual size: 337KB

.data Size: 48KB - Virtual size: 299KB

.rodata Size: 4KB - Virtual size: 2KB

.tls Size: 4KB - Virtual size: 2B

.reloc Size: 96KB - Virtual size: 93KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 340KB - Virtual size: 337KB

.data
Size: 48KB - Virtual size: 299KB

.rodata
Size: 4KB - Virtual size: 2KB

.tls
Size: 4KB - Virtual size: 2B

.reloc
Size: 96KB - Virtual size: 93KB