75e93f7ca6a7f8af0acbaaa6e7539935e7d4d1b2249961c999efea782aa035b0

Sharing

Copy URL Twitter E-mail

General

Target

75e93f7ca6a7f8af0acbaaa6e7539935e7d4d1b2249961c999efea782aa035b0
Size

2.7MB
MD5

f82d8a943cd44df2e54a0135345383fb
SHA1

d57da8bc094def3a7c393ab4c44e71fcc9e76747
SHA256

75e93f7ca6a7f8af0acbaaa6e7539935e7d4d1b2249961c999efea782aa035b0
SHA512

d7af8d2ab5c2b7fbb10f370160bb776a9dca2c537281ded11327b67077069948925b402b7e6e16fa0993a71730b1251013526164a6bba06b8cd88d5495f8dea6
SSDEEP

49152:6kwCIKQT5s7DackApZ0ElbX8PvJ7hBUz8ncgNr9euUQaUsCS1mL8Uf6Tj75:6kwz/TAkApaL3Pcg9ZUQq/1HD7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75e93f7ca6a7f8af0acbaaa6e7539935e7d4d1b2249961c999efea782aa035b0

Files

75e93f7ca6a7f8af0acbaaa6e7539935e7d4d1b2249961c999efea782aa035b0
.dll windows:5 windows x86 arch:x86

084ed7ff10215550169314ae666636a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleA
OutputDebugStringA
SystemTimeToFileTime
MoveFileExW
GetFileAttributesW
GetModuleFileNameW
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
FormatMessageW
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetCurrentProcessId
ConvertFiberToThread
ConvertThreadToFiber
FreeLibrary
LoadLibraryA
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
InitializeSListHead
GetCurrentProcess
ReleaseSemaphore
GetTickCount
DeleteCriticalSection
CreateWaitableTimerW
CreateIoCompletionPort
WaitForMultipleObjects
CreateEventW
QueueUserAPC
SetLastError
VerifyVersionInfoW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
TerminateThread
TlsSetValue
SleepEx
InterlockedCompareExchange
WaitForSingleObject
VerSetConditionMask
GetQueuedCompletionStatus
SetWaitableTimer
TlsGetValue
GetCurrentThreadId
TlsFree
CloseHandle
TlsAlloc
GetThreadTimes
PostQueuedCompletionStatus
InterlockedExchangeAdd
EnterCriticalSection
GetLastError
InterlockedExchange
LeaveCriticalSection
SetEvent
CreateEventA
WaitForSingleObjectEx
LocalFree
CreateWaitableTimerA
ResumeThread
OpenEventA
WaitForMultipleObjectsEx
ResetEvent
SetEndOfFile
GetFullPathNameW
SetEnvironmentVariableA
GetStringTypeW
WriteConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
RtlUnwind
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
TerminateProcess
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleCP
FlushFileBuffers
GetStartupInfoW
RaiseException
HeapSize
GetCurrentThread
GetFileInformationByHandle
SetFilePointerEx
GlobalAlloc
GlobalFree
InitializeCriticalSection
Sleep
GetDriveTypeW
OutputDebugStringW
FileTimeToSystemTime
CreateFileW
GetACP
SetConsoleCtrlHandler
RemoveDirectoryW
DeviceIoControl
FileTimeToLocalFileTime
DeleteFileW
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryA
VerifyVersionInfoA
EncodePointer
DecodePointer
GetTimeZoneInformation
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
CreateDirectoryW
GetFileAttributesExW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
ExitProcess
AreFileApisANSI
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

shell32

SHGetSpecialFolderPathW

ws2_32

getnameinfo
shutdown
ntohl
htonl
gethostname
sendto
setsockopt
WSAIoctl
__WSAFDIsSet
select
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
socket
freeaddrinfo
getaddrinfo
WSAGetLastError
ntohs
getsockopt
getsockname
ioctlsocket
WSAStartup
WSACleanup
getpeername
htons
recvfrom

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

wldap32

ord143
ord46
ord211
ord60
ord45
ord50
ord41
ord26
ord27
ord301
ord32
ord33
ord35
ord79
ord30
ord200
ord22

iphlpapi

GetAdaptersInfo

wininet

InternetTimeToSystemTimeA

oleaut32

VariantClear

Exports

Exports

addFPInfo
getUTDID
initAUDID
saveFPInfo
setAppName
setAppkeyAndSecret

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 538KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

084ed7ff10215550169314ae666636a9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

crypt32

wldap32

iphlpapi

wininet

oleaut32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 538KB - Virtual size: 538KB

.data Size: 32KB - Virtual size: 57KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 90KB - Virtual size: 90KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 538KB - Virtual size: 538KB

.data
Size: 32KB - Virtual size: 57KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 90KB - Virtual size: 90KB