775499385c3cd4c2784efba44562c532775784336c24055856751dcb52aa4bd5

Resubmissions

20/12/2023, 00:19

231220-ame2asbefp 7

20/12/2023, 00:13

231220-ahr53aeah9 3

Sharing

Copy URL Twitter E-mail

General

Target

775499385c3cd4c2784efba44562c532775784336c24055856751dcb52aa4bd5
Size

907KB
MD5

c4ce9dd5cb20fd825c235a10d71db086
SHA1

553ddbcafd7359280c11e102e73a87983439ebad
SHA256

775499385c3cd4c2784efba44562c532775784336c24055856751dcb52aa4bd5
SHA512

07093899a3c43d5079352648852efddab9bdb7628b73989bea7edcd08a5e3873cc7b8c4c51f477edd21d72e2c329ea8fa40300b9f61af7f698a8ab98230b7e8c
SSDEEP

12288:Eq0NrqGz2MwOicHZmIvXHkgozmOKQ/bqwWvTbfUmtqgWi4cRu:EvrqGzcZcrfkgUnDAM/cc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
775499385c3cd4c2784efba44562c532775784336c24055856751dcb52aa4bd5

Files

775499385c3cd4c2784efba44562c532775784336c24055856751dcb52aa4bd5
.dll windows:10 windows x64 arch:x64

f0fe3f9912d7bed2e28e64498577ce8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegOpenKeyExW
RegGetValueW
RegCloseKey
EventUnregister
EventRegister
EventSetInformation
EventWrite
EventEnabled

kernel32

SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
LocalFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RtlCaptureStackBackTrace
RaiseFailFastException
AcquireSRWLockShared
ReleaseSRWLockShared
LocalAlloc
InitOnceComplete
InitOnceBeginInitialize
GetModuleFileNameW
GetCurrentProcess
GetTickCount
InitializeSRWLock
SleepConditionVariableSRW
K32GetModuleInformation
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetFileType
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
LCMapStringW
CreateSemaphoreExW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
ExitProcess
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
RaiseException
CreateFileW
WriteConsoleW
HeapSize
HeapReAlloc
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
DeviceIoControl
WakeConditionVariable
CancelIoEx
GetOverlappedResultEx
CreateEventW
InterlockedPopEntrySList
SetFileTime
SetEndOfFile
UnlockFileEx
LockFileEx
GetFileTime
GetFullPathNameW
QueryPerformanceFrequency
GetDiskFreeSpaceW
CompareFileTime
HeapFree
FindFirstFileW
FindNextFileW
FindClose
SetEvent
ResetEvent
WakeAllConditionVariable
GetOverlappedResult
OutputDebugStringA
InitOnceExecuteOnce
DecodePointer
LCMapStringEx
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetLocaleInfoW

dbghelp

SymCleanup
SymFromName
SymGetTypeFromName
SymGetTypeInfo
SymLoadModuleEx
SymRegisterCallback64
SymInitializeW
SymSetOptions
SymGetOptions

oleaut32

SysStringLen
VariantInit
VariantClear
VariantChangeTypeEx

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize

shlwapi

PathAppendW
PathRemoveFileSpecW

ntdll

NtQueryInformationFile
NtFsControlFile
NtCreateFile
RtlNtStatusToDosError
RtlDecompressBufferEx
RtlGetCompressionWorkSpaceSize

Exports

Exports

RpplyGuestMemoryFix
RpplyPendingSavedStateFileReplayLog
RetArchitecture
RetGuestPhysicalMemoryChunks
RetGuestRawSavedMemorySize
RetPagingMode
RetRegisterValue
RetVpCount
RetWindowsCrashDumpHeader
RuestPhysicalAddressToRawSavedMemoryOffset
RuestVirtualAddressToPhysicalAddress
RoadSavedStateFile
RoadSavedStateFiles
RocateSavedStateFiles
ReadGuestPhysicalAddress
ReadGuestRawSavedMemory
ReleaseSavedStateFiles
T34

Sections

.text
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 292KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

f0fe3f9912d7bed2e28e64498577ce8f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

dbghelp

oleaut32

ole32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 390KB - Virtual size: 390KB

.rdata Size: 175KB - Virtual size: 175KB

.data Size: 7KB - Virtual size: 14KB

.pdata Size: 19KB - Virtual size: 19KB

.rsrc Size: 292KB - Virtual size: 288KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 390KB - Virtual size: 390KB

.rdata
Size: 175KB - Virtual size: 175KB

.data
Size: 7KB - Virtual size: 14KB

.pdata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 292KB - Virtual size: 288KB

.reloc
Size: 4KB - Virtual size: 3KB