ebc9a65d1614682e474ee6ab788b372d8435da3591c400b150473e91768d301f

Sharing

Copy URL Twitter E-mail

General

Target

ebc9a65d1614682e474ee6ab788b372d8435da3591c400b150473e91768d301f
Size

387KB
MD5

c1855fdb8e7d8881ccdf7e748dd63a5a
SHA1

508cc48f1849d28c0d8ca43fd7ec01dfd4ff75ed
SHA256

ebc9a65d1614682e474ee6ab788b372d8435da3591c400b150473e91768d301f
SHA512

a247a4953daa2075702c5805f767f39807db18c3b5abafeee3c6e9be74ff03b1c754f9189573dc3d792fac66c01465cb7cc6e4c71f183a6287df203d161f753a
SSDEEP

6144:1XmnFiU5yI4O+ddVoszOsKr851S3xfKsSoDUhxOm74TSPXsb:12nFXh4O+ddVosqsKY55voaxOmiSvsb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebc9a65d1614682e474ee6ab788b372d8435da3591c400b150473e91768d301f

Files

ebc9a65d1614682e474ee6ab788b372d8435da3591c400b150473e91768d301f
.dll windows:4 windows x86 arch:x86

333b3b7b59a02966b2c8e6ba089e747b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessDeniedAce
AddAccessDeniedAceEx
AllocateAndInitializeSid
FreeSid
GetCurrentHwProfileA
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegEnumValueA
RegEnumValueW
RegGetValueW
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
SetSecurityDescriptorDacl

gdi32

CreateHalftonePalette
DeleteObject
ExtTextOutA
GetDeviceCaps
GetTextExtentPointW
SelectObject
SetBkColor

kernel32

CreateFileMappingA
DelayLoadFailureHook
GetModuleHandleW
GetPrivateProfileStringW
IsBadStringPtrA
IsBadStringPtrW
LocalSize
RaiseException
ResolveDelayLoadedAPI
WritePrivateProfileStringW

kernelbase

ChrCmpIA
ChrCmpIW
CloseHandle
CreateSemaphoreW
CreateTimerQueueTimer
DisableThreadLibraryCalls
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetAcceptLanguagesA
GetAcceptLanguagesW
GetDateFormatW
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesW
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetNumberFormatW
GetProcAddress
GetStringTypeW
GetSystemDefaultUILanguage
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetTickCount
GetTimeFormatW
GetUserDefaultUILanguage
GetVersion
GetWindowsDirectoryW
HashData
HeapAlloc
HeapFree
HeapReAlloc
IsCharBlankW
IsCharCntrlW
IsCharDigitW
IsCharPunctW
IsCharSpaceA
IsCharSpaceW
IsCharXDigitW
IsDBCSLeadByte
IsInternetESCEnabled
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
MapViewOfFile
MultiByteToWideChar
OpenProcess
OpenSemaphoreW
ParseURLA
ParseURLW
PathAddBackslashA
PathAddBackslashW
PathAddExtensionA
PathAddExtensionW
PathAppendA
PathAppendW
PathCanonicalizeA
PathCanonicalizeW
PathCombineA
PathCombineW
PathCommonPrefixA
PathCommonPrefixW
PathCreateFromUrlA
PathCreateFromUrlAlloc
PathCreateFromUrlW
PathFileExistsA
PathFileExistsW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameA
PathFindFileNameW
PathFindNextComponentA
PathFindNextComponentW
PathGetArgsA
PathGetArgsW
PathGetCharTypeA
PathGetCharTypeW
PathGetDriveNumberA
PathGetDriveNumberW
PathIsFileSpecA
PathIsFileSpecW
PathIsLFNFileSpecA
PathIsLFNFileSpecW
PathIsPrefixA
PathIsPrefixW
PathIsRelativeA
PathIsRelativeW
PathIsRootA
PathIsRootW
PathIsSameRootA
PathIsSameRootW
PathIsUNCA
PathIsUNCServerA
PathIsUNCServerShareA
PathIsUNCServerShareW
PathIsUNCServerW
PathIsUNCW
PathIsURLA
PathIsURLW
PathIsValidCharA
PathIsValidCharW
PathMatchSpecA
PathMatchSpecExA
PathMatchSpecExW
PathMatchSpecW
PathParseIconLocationA
PathParseIconLocationW
PathQuoteSpacesA
PathQuoteSpacesW
PathRelativePathToA
PathRelativePathToW
PathRemoveBackslashA
PathRemoveBackslashW
PathRemoveBlanksA
PathRemoveBlanksW
PathRemoveExtensionA
PathRemoveExtensionW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathRenameExtensionA
PathRenameExtensionW
PathSearchAndQualifyA
PathSearchAndQualifyW
PathSkipRootA
PathSkipRootW
PathStripPathA
PathStripPathW
PathStripToRootA
PathStripToRootW
PathUnExpandEnvStringsA
PathUnExpandEnvStringsW
PathUnquoteSpacesA
PathUnquoteSpacesW
QISearch
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
ReleaseSemaphore
SHLoadIndirectString
SHRegCloseUSKey
SHRegCreateUSKeyA
SHRegCreateUSKeyW
SHRegDeleteEmptyUSKeyA
SHRegDeleteEmptyUSKeyW
SHRegDeleteUSValueA
SHRegDeleteUSValueW
SHRegEnumUSKeyA
SHRegEnumUSKeyW
SHRegEnumUSValueA
SHRegEnumUSValueW
SHRegGetBoolUSValueA
SHRegGetBoolUSValueW
SHRegGetUSValueA
SHRegGetUSValueW
SHRegOpenUSKeyA
SHRegOpenUSKeyW
SHRegQueryInfoUSKeyA
SHRegQueryInfoUSKeyW
SHRegQueryUSValueA
SHRegQueryUSValueW
SHRegSetUSValueA
SHRegSetUSValueW
SHRegWriteUSValueA
SHRegWriteUSValueW
SHTruncateString
SetErrorMode
SetFileAttributesA
SetFileAttributesW
StrCSpnA
StrCSpnIA
StrCSpnIW
StrCSpnW
StrCatBuffA
StrCatBuffW
StrCatChainW
StrChrA
StrChrIA
StrChrIW
StrChrNW
StrChrW
StrCmpCA
StrCmpCW
StrCmpICA
StrCmpICW
StrCmpIW
StrCmpLogicalW
StrCmpNA
StrCmpNCA
StrCmpNCW
StrCmpNIA
StrCmpNICA
StrCmpNICW
StrCmpNIW
StrCmpNW
StrCmpW
StrCpyNW
StrCpyNXA
StrCpyNXW
StrDupA
StrDupW
StrIsIntlEqualA
StrIsIntlEqualW
StrPBrkA
StrPBrkW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrIA
StrRStrIW
StrSpnA
StrSpnW
StrStrA
StrStrIA
StrStrIW
StrStrNIW
StrStrNW
StrStrW
StrToInt64ExA
StrToInt64ExW
StrToIntA
StrToIntExA
StrToIntExW
StrToIntW
StrTrimA
StrTrimW
UnmapViewOfFile
UrlApplySchemeA
UrlApplySchemeW
UrlCanonicalizeA
UrlCanonicalizeW
UrlCombineA
UrlCombineW
UrlCompareA
UrlCompareW
UrlCreateFromPathA
UrlCreateFromPathW
UrlEscapeA
UrlEscapeW
UrlFixupW
UrlGetLocationA
UrlGetLocationW
UrlGetPartA
UrlGetPartW
UrlHashA
UrlHashW
UrlIsA
UrlIsNoHistoryA
UrlIsNoHistoryW
UrlIsOpaqueA
UrlIsOpaqueW
UrlIsW
UrlUnescapeA
UrlUnescapeW
VerQueryValueW
WaitForSingleObject
WideCharToMultiByte
lstrcmpiA

ntdll

RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
_vsnprintf

shcore

SHDeleteValueA
SHDeleteValueW
SHGetValueA
SHGetValueW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetPathA
SHRegGetPathW
SHRegSetPathA
SHRegSetPathW
SHSetValueA
SHSetValueW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
_wcsicmp
free
fwrite
getenv
islower
iswlower
memcmp
memcpy
memmove
memset
strchr
strcmp
strcpy
strcspn
strlen
strrchr
tolower
towlower
wcscmp
wcslen
wcsrchr

user32

CharNextA
CharPrevA
CheckMenuItem
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyMenu
DialogBoxParamW
EnableMenuItem
EndDialog
EnumChildWindows
GetClassInfoA
GetClassInfoW
GetClientRect
GetDC
GetDlgItem
GetMenuDefaultItem
GetMenuItemCount
GetMenuItemInfoW
GetParent
GetPropA
GetSubMenu
GetSystemMetrics
GetWindowLongW
IsChild
IsWindowUnicode
LoadCursorA
LoadCursorW
LoadMenuW
LoadStringW
MessageBoxW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageA
PostMessageW
RegisterClassA
RegisterClassW
RegisterClipboardFormatA
ReleaseDC
RemoveMenu
RemovePropA
SendMessageA
SendMessageTimeoutA
SendMessageTimeoutW
SendMessageW
SetParent
SetWindowLongA
SetWindowLongW
SetWindowTextW
ShowWindow
UnregisterClassA
UnregisterClassW
wsprintfW

Exports

Exports

AssocCreate
AssocGetPerceivedType
AssocIsDangerous
AssocQueryKeyA
AssocQueryKeyW
AssocQueryStringA
AssocQueryStringByKeyA
AssocQueryStringByKeyW
AssocQueryStringW
ChrCmpIA
ChrCmpIW
ColorAdjustLuma
ColorHLSToRGB
ColorRGBToHLS
ConnectToConnectionPoint
DelayLoadFailureHook
DllGetVersion
GetAcceptLanguagesA
GetAcceptLanguagesW
GetMenuPosFromID
HashData
IStream_Read
IStream_ReadPidl
IStream_Reset
IStream_Size
IStream_Write
IStream_WritePidl
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_GetWindow
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IntlStrEqWorkerA
IntlStrEqWorkerW
IsCharSpaceA
IsCharSpaceW
IsInternetESCEnabled
IsOS
MLFreeLibrary
MLLoadLibraryA
MLLoadLibraryW
ParseURLA
ParseURLW
PathAddBackslashA
PathAddBackslashW
PathAddExtensionA
PathAddExtensionW
PathAppendA
PathAppendW
PathBuildRootA
PathBuildRootW
PathCanonicalizeA
PathCanonicalizeW
PathCombineA
PathCombineW
PathCommonPrefixA
PathCommonPrefixW
PathCompactPathA
PathCompactPathExA
PathCompactPathExW
PathCompactPathW
PathCreateFromUrlA
PathCreateFromUrlAlloc
PathCreateFromUrlW
PathFileExistsA
PathFileExistsW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameA
PathFindFileNameW
PathFindNextComponentA
PathFindNextComponentW
PathFindOnPathA
PathFindOnPathW
PathFindSuffixArrayA
PathFindSuffixArrayW
PathGetArgsA
PathGetArgsW
PathGetCharTypeA
PathGetCharTypeW
PathGetDriveNumberA
PathGetDriveNumberW
PathIsContentTypeA
PathIsContentTypeW
PathIsDirectoryA
PathIsDirectoryEmptyA
PathIsDirectoryEmptyW
PathIsDirectoryW
PathIsFileSpecA
PathIsFileSpecW
PathIsLFNFileSpecA
PathIsLFNFileSpecW
PathIsNetworkPathA
PathIsNetworkPathW
PathIsPrefixA
PathIsPrefixW
PathIsRelativeA
PathIsRelativeW
PathIsRootA
PathIsRootW
PathIsSameRootA
PathIsSameRootW
PathIsSystemFolderA
PathIsSystemFolderW
PathIsUNCA
PathIsUNCServerA
PathIsUNCServerShareA
PathIsUNCServerShareW
PathIsUNCServerW
PathIsUNCW
PathIsURLA
PathIsURLW
PathMakePrettyA
PathMakePrettyW
PathMakeSystemFolderA
PathMakeSystemFolderW
PathMatchSpecA
PathMatchSpecExA
PathMatchSpecExW
PathMatchSpecW
PathParseIconLocationA
PathParseIconLocationW
PathQuoteSpacesA
PathQuoteSpacesW
PathRelativePathToA
PathRelativePathToW
PathRemoveArgsA
PathRemoveArgsW
PathRemoveBackslashA
PathRemoveBackslashW
PathRemoveBlanksA
PathRemoveBlanksW
PathRemoveExtensionA
PathRemoveExtensionW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathRenameExtensionA
PathRenameExtensionW
PathSearchAndQualifyA
PathSearchAndQualifyW
PathSetDlgItemPathA
PathSetDlgItemPathW
PathSkipRootA
PathSkipRootW
PathStripPathA
PathStripPathW
PathStripToRootA
PathStripToRootW
PathUnExpandEnvStringsA
PathUnExpandEnvStringsW
PathUndecorateA
PathUndecorateW
PathUnmakeSystemFolderA
PathUnmakeSystemFolderW
PathUnquoteSpacesA
PathUnquoteSpacesW
QISearch
SHAllocShared
SHAnsiToAnsi
SHAnsiToUnicode
SHAutoComplete
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateShellPalette
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateStreamWrapper
SHCreateThread
SHCreateThreadRef
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteOrphanKeyA
SHDeleteOrphanKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHFormatDateTimeA
SHFormatDateTimeW
SHFreeShared
SHGetInverseCMAP
SHGetThreadRef
SHGetValueA
SHGetValueW
SHGetViewStatePropertyBag
SHIsChildOrSelf
SHIsLowMemoryMachine
SHLoadIndirectString
SHLockShared
SHMessageBoxCheckA
SHMessageBoxCheckW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegCloseUSKey
SHRegCreateUSKeyA
SHRegCreateUSKeyW
SHRegDeleteEmptyUSKeyA
SHRegDeleteEmptyUSKeyW
SHRegDeleteUSValueA
SHRegDeleteUSValueW
SHRegDuplicateHKey
SHRegEnumUSKeyA
SHRegEnumUSKeyW
SHRegEnumUSValueA
SHRegEnumUSValueW
SHRegGetBoolUSValueA
SHRegGetBoolUSValueW
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetUSValueA
SHRegGetUSValueW
SHRegGetValueA
SHRegGetValueW
SHRegOpenUSKeyA
SHRegOpenUSKeyW
SHRegQueryInfoUSKeyA
SHRegQueryInfoUSKeyW
SHRegQueryUSValueA
SHRegQueryUSValueW
SHRegSetPathA
SHRegSetPathW
SHRegSetUSValueA
SHRegSetUSValueW
SHRegWriteUSValueA
SHRegWriteUSValueW
SHRegisterValidateTemplate
SHReleaseThreadRef
SHRunIndirectRegClientCommand
SHSendMessageBroadcastA
SHSendMessageBroadcastW
SHSetThreadRef
SHSetValueA
SHSetValueW
SHSkipJunction
SHStrDupA
SHStrDupW
SHStripMneumonicA
SHStripMneumonicW
SHUnicodeToAnsi
SHUnicodeToUnicode
SHUnlockShared
ShellMessageBoxWrapW
StrCSpnA
StrCSpnIA
StrCSpnIW
StrCSpnW
StrCatBuffA
StrCatBuffW
StrCatChainW
StrCatW
StrChrA
StrChrIA
StrChrIW
StrChrNW
StrChrW
StrCmpCA
StrCmpCW
StrCmpICA
StrCmpICW
StrCmpIW
StrCmpLogicalW
StrCmpNA
StrCmpNCA
StrCmpNCW
StrCmpNIA
StrCmpNICA
StrCmpNICW
StrCmpNIW
StrCmpNW
StrCmpW
StrCpyNW
StrCpyW
StrDupA
StrDupW
StrFormatByteSize64A
StrFormatByteSizeA
StrFormatByteSizeW
StrFormatKBSizeA
StrFormatKBSizeW
StrFromTimeIntervalA
StrFromTimeIntervalW
StrIsIntlEqualA
StrIsIntlEqualW
StrNCatA
StrNCatW
StrPBrkA
StrPBrkW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrIA
StrRStrIW
StrRetToBSTR
StrRetToBufA
StrRetToBufW
StrRetToStrA
StrRetToStrW
StrSpnA
StrSpnW
StrStrA
StrStrIA
StrStrIW
StrStrNIW
StrStrNW
StrStrW
StrToInt64ExA
StrToInt64ExW
StrToIntA
StrToIntExA
StrToIntExW
StrToIntW
StrTrimA
StrTrimW
UrlApplySchemeA
UrlApplySchemeW
UrlCanonicalizeA
UrlCanonicalizeW
UrlCombineA
UrlCombineW
UrlCompareA
UrlCompareW
UrlCreateFromPathA
UrlCreateFromPathW
UrlEscapeA
UrlEscapeW
UrlFixupW
UrlGetLocationA
UrlGetLocationW
UrlGetPartA
UrlGetPartW
UrlHashA
UrlHashW
UrlIsA
UrlIsNoHistoryA
UrlIsNoHistoryW
UrlIsOpaqueA
UrlIsOpaqueW
UrlIsW
UrlUnescapeA
UrlUnescapeW
WhichPlatform
_SHGetInstanceExplorer
wnsprintfA
wnsprintfW
wvnsprintfA
wvnsprintfW

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 288B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

333b3b7b59a02966b2c8e6ba089e747b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

kernelbase

ntdll

shcore

ucrtbase

user32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 126KB

.data Size: 4KB - Virtual size: 648B

.rodata Size: 8KB - Virtual size: 6KB

.rdata Size: 52KB - Virtual size: 49KB

/4 Size: 28KB - Virtual size: 24KB

.bss Size: - Virtual size: 288B

.edata Size: 100KB - Virtual size: 97KB

.idata Size: 16KB - Virtual size: 13KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 128KB - Virtual size: 126KB

.data
Size: 4KB - Virtual size: 648B

.rodata
Size: 8KB - Virtual size: 6KB

.rdata
Size: 52KB - Virtual size: 49KB

/4
Size: 28KB - Virtual size: 24KB

.bss
Size: - Virtual size: 288B

.edata
Size: 100KB - Virtual size: 97KB

.idata
Size: 16KB - Virtual size: 13KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 8KB - Virtual size: 6KB