920627c1af776e4ea7f4fc910462ad3dd48315320d15516aae44e1910b2556bf

Sharing

Copy URL Twitter E-mail

General

Target

920627c1af776e4ea7f4fc910462ad3dd48315320d15516aae44e1910b2556bf
Size

564KB
MD5

0e8dd4969bb6425197abe8fdb30e9200
SHA1

1b10907aabe7946d452728bcef1c5d55e8f16b0f
SHA256

920627c1af776e4ea7f4fc910462ad3dd48315320d15516aae44e1910b2556bf
SHA512

3cfa4bafa8bd74adf126b84903f9d541fcee296f81c8c4b0ac3f94448f30e22df6cd245fb4823e86a26d7356e4b57ab456c6fa90b85b8ef87c7dbfdee7133575
SSDEEP

12288:HUpUSzYnTOSmgqTaLYiM8MCfg/2WQ5hp3u6HJJhk158Gz:H3nCSTqmLYifMVjchphJrk38

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
920627c1af776e4ea7f4fc910462ad3dd48315320d15516aae44e1910b2556bf

Files

920627c1af776e4ea7f4fc910462ad3dd48315320d15516aae44e1910b2556bf
.dll windows:6 windows x64 arch:x64

21ddf1f7efb9263414b9f4d0c1c42014

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetThreadPriority
GetSystemDirectoryW
CreateEventW
LoadLibraryW
SetThreadExecutionState
EnterCriticalSection
ReleaseSemaphore
GetProcessAffinityMask
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
DeleteCriticalSection
CreateSemaphoreW
LocalFileTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
CompareStringW
GetCPInfo
MultiByteToWideChar
IsDBCSLeadByte
WideCharToMultiByte
LocalFree
GetCurrentThreadId
GetModuleHandleA
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
DosDateTimeToFileTime
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
SetThreadAffinityMask
ResumeThread
FreeLibrary
GetProcAddress
GetCurrentDirectoryW
FoldStringW
GetVersionExW
FindClose
FindFirstFileW
GetCurrentProcessId
GetFileAttributesW
SetFilePointer
ReadFile
MoveFileW
GetShortPathNameW
GetLongPathNameW
CloseHandle
DeleteFileW
CreateFileW
CreateHardLinkW
SetFileTime
RemoveDirectoryW
DeviceIoControl
GetCurrentProcess
CreateDirectoryW
GetLastError
Sleep
AreFileApisANSI
GetFileType
GetStdHandle
InitializeCriticalSectionEx
InitializeSListHead
DisableThreadLibraryCalls
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetTickCount64
SetLastError

user32

CharToOemA
OemToCharA
CharUpperW
CharLowerW
OemToCharBuffA
CharToOemBuffW

advapi32

LookupPrivilegeValueW
OpenProcessToken
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
SetFileSecurityW
AdjustTokenPrivileges

ole32

CoSetProxyBlanket
CoCreateInstance
CoCreateGuid

oleaut32

SysAllocStringLen
VariantCopy
VariantClear
SysStringLen
SysFreeString
SysAllocString

zlib1

inflateInit2_
crc32
inflateReset
inflate
inflateEnd

shared

uFormatSystemErrorMessage
GetInfiniteWaitEvent
uGetTempPath
stricmp_utf8
??0uCallStackTracker@@QEAA@PEBD@Z
??1uCallStackTracker@@QEAA@XZ
uPrintCrashInfo_OnEvent
uBugCheck

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
strchr
strrchr
__C_specific_handler
strstr
memmove
memset
memcmp
memcpy
wcsrchr
_CxxThrowException
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
__current_exception_context
wcschr
__std_terminate
_purecall
wcsstr

api-ms-win-crt-runtime-l1-1-0

abort
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
exit
_configure_narrow_argv
_beginthreadex
_initialize_narrow_environment
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_strdup
_wcsicmp
strlen
wcsncpy
_wcsdup
wcsncmp
wcspbrk
strncmp

api-ms-win-crt-heap-l1-1-0

free
realloc
_callnewh
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-math-l1-1-0

lround

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 460KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

21ddf1f7efb9263414b9f4d0c1c42014

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

zlib1

shared

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 460KB - Virtual size: 459KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 5KB - Virtual size: 44KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 472B

.reloc Size: 3KB - Virtual size: 3KB

.movehcs Size: 512B - Virtual size: 4KB

.text
Size: 460KB - Virtual size: 459KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 5KB - Virtual size: 44KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 472B

.reloc
Size: 3KB - Virtual size: 3KB

.movehcs
Size: 512B - Virtual size: 4KB