d44370e3d3730257fc26cb4816c346e8c3397096b83ab40b584547df9f3a50b9

Sharing

Copy URL Twitter E-mail

General

Target

d44370e3d3730257fc26cb4816c346e8c3397096b83ab40b584547df9f3a50b9
Size

612KB
MD5

6bb6223cd37ce40d06b144718bf1f320
SHA1

b9f4eb386028869fb3d64651c9bcde6d73eacb0f
SHA256

d44370e3d3730257fc26cb4816c346e8c3397096b83ab40b584547df9f3a50b9
SHA512

09240585da2cab34f406f7fca1d6f70f934a1d3394feabbe1d6d42b59fc37d1590303ce7a04917b8d286965b73132b9cafda8d2302004f2d92994f80ea7cf809
SSDEEP

12288:eeGAzWYiTAKap8Em+zTxLTg8Jgorhiqh/5dKvxV:ebAzDiEKI8EhPxLTfpnK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d44370e3d3730257fc26cb4816c346e8c3397096b83ab40b584547df9f3a50b9

Files

d44370e3d3730257fc26cb4816c346e8c3397096b83ab40b584547df9f3a50b9
.dll regsvr32 windows:4 windows x86 arch:x86

ea4bc89611148f3b7ccd759c4ee39c9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
GetDriveTypeW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetModuleFileNameW
GetModuleHandleA
GetPrivateProfileStringW
GetProcAddress
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersionExW
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryW
ResolveDelayLoadedAPI
RtlUnwind
SetFilePointerEx
SizeofResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
lstrcmpiW

ntdll

RtlIpv6AddressToStringExW
RtlIpv6StringToAddressW
_vsnprintf

ole32

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoMarshalInterface
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUnmarshalInterface
CreateBindCtx
CreateGenericComposite
CreateStreamOnHGlobal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
MkParseDisplayName
ReleaseStgMedium
STGMEDIUM_UserFree
STGMEDIUM_UserMarshal
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
StringFromCLSID

oleaut32

BSTR_UserFree
BSTR_UserMarshal
BSTR_UserSize
BSTR_UserUnmarshal
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConformantStringBufferSize
NdrConformantStringMarshall
NdrConformantStringUnmarshall
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConformantStructUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrSimpleTypeMarshall
NdrSimpleTypeUnmarshall
NdrStubGetBuffer
NdrStubInitialize
NdrUserMarshalBufferSize
NdrUserMarshalMarshall
NdrUserMarshalUnmarshall
RpcRaiseException

shell32

ShellExecuteExW

shlwapi

ord2
PathCreateFromUrlW
PathFindExtensionW
StrChrW
StrCmpNIW
StrCmpNW
UrlCanonicalizeW
UrlCombineW
UrlCompareW
UrlGetPartW
UrlUnescapeW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_strdup
_wcsicmp
_wcsnicmp
free
fwrite
getenv
iswalpha
iswcntrl
iswspace
iswupper
memcmp
memcpy
memmove
memset
strchr
strcmp
strcpy
strcspn
strlen
towlower
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcstol

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableWindow
EndDialog
GetDlgItem
GetPropW
KillTimer
LoadIconW
LoadStringW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
RegisterClassExW
RegisterClipboardFormatW
SendDlgItemMessageW
SetDlgItemTextW
SetPropW
SetTimer
TranslateMessage
UnregisterClassW
wsprintfW

wininet

CommitUrlCacheEntryW
CreateUrlCacheEntryW
FtpGetFileSize
HttpEndRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetErrorDlg
InternetLockRequestFile
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
InternetUnlockRequestFile
InternetWriteFile

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIUriPriv
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IEInstallScope
IsAsyncMoniker
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldShowIntranetWarningSecband
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 360KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 228B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea4bc89611148f3b7ccd759c4ee39c9b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

ucrtbase

user32

wininet

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 357KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 80KB - Virtual size: 78KB

.bss Size: - Virtual size: 228B

.edata Size: 68KB - Virtual size: 64KB

.idata Size: 12KB - Virtual size: 8KB

.rsrc Size: 60KB - Virtual size: 57KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 360KB - Virtual size: 357KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 80KB - Virtual size: 78KB

.bss
Size: - Virtual size: 228B

.edata
Size: 68KB - Virtual size: 64KB

.idata
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 60KB - Virtual size: 57KB

.reloc
Size: 20KB - Virtual size: 17KB