1737c239b94153b8eefe193839e52d09

Sharing

Copy URL Twitter E-mail

General

Target

1737c239b94153b8eefe193839e52d09
Size

949KB
MD5

1737c239b94153b8eefe193839e52d09
SHA1

a6ca381d8131e2a15a2e6bfe8752f81038224256
SHA256

2ef97efc38e96c8d2708a34ee143d78fa918efcaf76e27acb4629bc5e311240e
SHA512

2c6cc82c4d6b2ef87b2a89aaa311e23c1eead0fedd0237844529e1019c2b4f223014a27098d7091ed8cdb0597bf6954c007ca113502de32fd14937824922be5b
SSDEEP

24576:Kd9UN32Hvkq+zJG45dmCIuxrMJNMy2wSbP:UUB2HIIu1MAjP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1737c239b94153b8eefe193839e52d09

Files

1737c239b94153b8eefe193839e52d09
.dll windows:6 windows x64 arch:x64

02a4ae865f19cef2a1fa0dff30ae8bc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
CreateSemaphoreW
AddAtomW
FindAtomW
ReplaceFileA
GetNamedPipeHandleStateA
SystemTimeToFileTime
EnumSystemLocalesW
SetEndOfFile
SetCommConfig
GetCommConfig
DeleteAtom
GetBinaryTypeW
LocalFree
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetTickCount
GetSystemTime
GetStartupInfoW
TerminateThread
CreateThread
GetCurrentProcess
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
DisconnectNamedPipe
HeapSize
WriteConsoleW
SetFilePointerEx
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ConnectNamedPipe
CreatePipe
GetLastError
CloseHandle
ReadFile
GetFileSize
CreateFileW
FindClose
ReadConsoleW
FlushFileBuffers
GetStdHandle
LCMapStringW
CompareStringW
GetFileAttributesExW
CreateProcessA
GetExitCodeProcess
GetStringTypeW
GetConsoleMode
GetConsoleCP
WriteFile
GetFileType
SetStdHandle
HeapReAlloc
HeapFree
HeapAlloc
GetACP
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary

gdi32

CreatePolygonRgn
DeleteEnhMetaFile
SetPaletteEntries
GetPaletteEntries
DeleteObject
CreateBitmap
GetEnhMetaFileA
Arc

advapi32

LockServiceDatabase
CreateWellKnownSid
EqualDomainSid
DuplicateTokenEx
GetTokenInformation
LookupAccountSidA
CloseServiceHandle
CreateServiceW
GetTrusteeTypeA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
GetExplicitEntriesFromAclW
LsaEnumerateAccountRights
LsaOpenPolicy
LsaClose
LsaFreeMemory
UnlockServiceDatabase
StartServiceW
OpenSCManagerA
DeleteService
OpenProcessToken

shell32

SHGetSettings
SHGetInstanceExplorer
ord4
ord2
ord245
SHSetUnreadMailCountW
SHGetUnreadMailCountW
SHIsFileAvailableOffline
SHGetDiskFreeSpaceExW
DragQueryFileA
ord47

dbghelp

SymGetModuleInfo64
GetTimestampForLoadedLibrary
SymGetSearchPath
SymSetSearchPath
SymGetSymPrev64
SymInitialize
SymCleanup
StackWalk64

imm32

ImmGetGuideLineA
ImmGetCandidateListCountA
ImmGetConversionListW
ImmRegisterWordA
ImmUnregisterWordA
ImmEscapeA

winmm

waveOutGetErrorTextA
waveOutGetNumDevs
mmioAscend
midiOutGetNumDevs
mmioClose
mmioRenameW
mmioOpenA
mmioInstallIOProcW
mciGetCreatorTask
mciGetDeviceIDFromElementIDA
mciGetDeviceIDW
mciGetDeviceIDA
mciSendStringA
midiOutGetErrorTextW
midiOutGetID
midiInGetNumDevs
midiInGetDevCapsA
midiInGetErrorTextW
midiInGetID
midiInMessage
mixerGetNumDevs
mixerGetDevCapsA
waveOutGetID
mixerGetID
mmioDescend
mciGetErrorStringA

rpcrt4

MesDecodeBufferHandleCreate
MesEncodeFixedBufferHandleCreate
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
MesHandleFree

Sections

.text
Size: 475KB - Virtual size: 474KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02a4ae865f19cef2a1fa0dff30ae8bc7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

dbghelp

imm32

winmm

rpcrt4

Sections

.text Size: 475KB - Virtual size: 474KB

.rdata Size: 448KB - Virtual size: 448KB

.data Size: 8KB - Virtual size: 12.0MB

.pdata Size: 13KB - Virtual size: 13KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 475KB - Virtual size: 474KB

.rdata
Size: 448KB - Virtual size: 448KB

.data
Size: 8KB - Virtual size: 12.0MB

.pdata
Size: 13KB - Virtual size: 13KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 2KB