cd72611601ed6cbb28505e25b7af7221e8e9793422af63a31c98c51487cfb759

Sharing

Copy URL Twitter E-mail

General

Target

cd72611601ed6cbb28505e25b7af7221e8e9793422af63a31c98c51487cfb759
Size

1024KB
MD5

071f06a7b6197faf0078198a1ba785ab
SHA1

dcb702495bd5e39382880d2786c5aa78897b58a5
SHA256

cd72611601ed6cbb28505e25b7af7221e8e9793422af63a31c98c51487cfb759
SHA512

8f3862a18a344fb21fb1329f5e90daef3f57412bf2993c2282ff67853c9c425c15392e98ead6c1e0d44788e2920d9c24b221624e0913b75835e78d77a3ae9e41
SSDEEP

24576:g2mj42MEVQPGEorkSYPuX/7DkbSrh/qtoT/cgB8Sn3:2jnMEVQuFkS/vkurNqtoTkgCSn3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd72611601ed6cbb28505e25b7af7221e8e9793422af63a31c98c51487cfb759

Files

cd72611601ed6cbb28505e25b7af7221e8e9793422af63a31c98c51487cfb759
.dll windows:5 windows x86 arch:x86

42dd31ca86c177758d73ef96895182f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
GetModuleHandleW
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcessId
ReadFile
InterlockedCompareExchange
SetFilePointer
FreeLibraryAndExitThread
HeapSize
GetPrivateProfileStringW
LockResource
FindResourceExW
HeapDestroy
GetProcessHeap
GetCurrentProcess
GetSystemWindowsDirectoryW
GetVersionExW
FreeResource
SetFilePointerEx
GetFileSizeEx
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
lstrcmpA
LocalFree
GetFileSize
WriteFile
GetLocalTime
GetCurrentThreadId
FlushFileBuffers
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
MoveFileExW
QueryPerformanceCounter
LockFileEx
UnlockFileEx
MapViewOfFile
GetModuleHandleExW
CreateThread
GetFileType
ReleaseMutex
GetACP
lstrlenA
LocalFileTimeToFileTime
InterlockedExchange
MultiByteToWideChar
GetUserDefaultLCID
LoadLibraryW
GetProcAddress
GetModuleFileNameW
FreeLibrary
VirtualProtect
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
TerminateProcess
Sleep
CreateMutexW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
CreateFileW
FindNextFileA
FindFirstFileExA
SetStdHandle
GetConsoleCP
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetModuleFileNameA
ExitProcess
InterlockedFlushSList
RtlUnwind
OpenThread
HeapWalk
HeapUnlock
HeapLock
CreateFileA
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcatA
GlobalMemoryStatus
LoadLibraryA
GetSystemDirectoryA
GetModuleHandleA
GetStdHandle
GetCPInfo
GetStringTypeW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
OutputDebugStringW
IsDebuggerPresent
InitializeCriticalSection
GetTickCount
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle
GetFileAttributesW
lstrcmpiA

user32

MessageBoxA
CharNextW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

ReportEventA
DeregisterEventSource
RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
GetTokenInformation
OpenProcessToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterEventSourceA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

SysAllocString
VarUI4FromStr

shlwapi

SHGetValueA
PathFindFileNameW
StrRChrW
PathCombineW
PathAppendW
StrTrimA
PathFileExistsW
SHGetValueW
PathRemoveFileSpecW
StrCmpIW
StrCmpNIW
StrStrIW
StrStrIA
PathAddBackslashW
SHSetValueA
SHSetValueW

version

VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CryptMsgControl
CertFindCertificateInStore
CryptQueryObject
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CryptDecodeObjectEx
CryptDecodeObject
CertGetCertificateChain
CertAddStoreToCollection
CertOpenStore
CertCloseStore
CertOpenSystemStoreW
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CertFreeCertificateChain
CryptMsgOpenToDecode

iphlpapi

GetAdaptersInfo

Exports

Exports

BaseCheckProductType
BaseGetProductPath
BaseGetProductRegRoot
BaseIsOnlySha1Sign
CreateObject
InitLibs

Sections

.text
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42dd31ca86c177758d73ef96895182f6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

version

crypt32

iphlpapi

Exports

Exports

Sections

.text Size: 755KB - Virtual size: 754KB

.rdata Size: 219KB - Virtual size: 218KB

.data Size: 10KB - Virtual size: 23KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 38KB - Virtual size: 38KB

.text
Size: 755KB - Virtual size: 754KB

.rdata
Size: 219KB - Virtual size: 218KB

.data
Size: 10KB - Virtual size: 23KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 38KB - Virtual size: 38KB