7a2e6f7b8e84538c064ebf2b42eabffd9be2b6123d77da356dd74eaf46dd082d

Sharing

Copy URL

Twitter E-mail

General

Target

7a2e6f7b8e84538c064ebf2b42eabffd9be2b6123d77da356dd74eaf46dd082d
Size

2.7MB
MD5

fea7fb610fc101418a9b5129539890ed
SHA1

45464456f58ca385f2f14bf009b4919886282678
SHA256

7a2e6f7b8e84538c064ebf2b42eabffd9be2b6123d77da356dd74eaf46dd082d
SHA512

6e3f5729c814c5cfce2040e07c77b892cbb6c2955455534631ba415a676a2ca92328757220136be587088c72b7cc0842664272e0dac3c6dd9de0af0d60ad8ea6
SSDEEP

24576:Xqc+KpPzhl0IsK8MSGd+cFgtc1D9HqAeX3trNVyRUzf6Tlpq:6kz0ySsFgG1AAMNVGUf6T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a2e6f7b8e84538c064ebf2b42eabffd9be2b6123d77da356dd74eaf46dd082d

Files

7a2e6f7b8e84538c064ebf2b42eabffd9be2b6123d77da356dd74eaf46dd082d
.dll windows:5 windows x86 arch:x86

084ed7ff10215550169314ae666636a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleA
OutputDebugStringA
SystemTimeToFileTime
MoveFileExW
GetFileAttributesW
GetModuleFileNameW
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
FormatMessageW
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetCurrentProcessId
ConvertFiberToThread
ConvertThreadToFiber
FreeLibrary
LoadLibraryA
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
InitializeSListHead
GetCurrentProcess
ReleaseSemaphore
GetTickCount
DeleteCriticalSection
CreateWaitableTimerW
CreateIoCompletionPort
WaitForMultipleObjects
CreateEventW
QueueUserAPC
SetLastError
VerifyVersionInfoW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
TerminateThread
TlsSetValue
SleepEx
InterlockedCompareExchange
WaitForSingleObject
VerSetConditionMask
GetQueuedCompletionStatus
SetWaitableTimer
TlsGetValue
GetCurrentThreadId
TlsFree
CloseHandle
TlsAlloc
GetThreadTimes
PostQueuedCompletionStatus
InterlockedExchangeAdd
EnterCriticalSection
GetLastError
InterlockedExchange
LeaveCriticalSection
SetEvent
CreateEventA
WaitForSingleObjectEx
LocalFree
CreateWaitableTimerA
ResumeThread
OpenEventA
WaitForMultipleObjectsEx
ResetEvent
SetEndOfFile
GetFullPathNameW
SetEnvironmentVariableA
GetStringTypeW
WriteConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
RtlUnwind
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
TerminateProcess
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleCP
FlushFileBuffers
GetStartupInfoW
RaiseException
HeapSize
GetCurrentThread
GetFileInformationByHandle
SetFilePointerEx
GlobalAlloc
GlobalFree
InitializeCriticalSection
Sleep
GetDriveTypeW
OutputDebugStringW
FileTimeToSystemTime
CreateFileW
GetACP
SetConsoleCtrlHandler
RemoveDirectoryW
DeviceIoControl
FileTimeToLocalFileTime
DeleteFileW
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryA
VerifyVersionInfoA
EncodePointer
DecodePointer
GetTimeZoneInformation
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
CreateDirectoryW
GetFileAttributesExW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
ExitProcess
AreFileApisANSI
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource

shell32

SHGetSpecialFolderPathW

ws2_32

getnameinfo
shutdown
ntohl
htonl
gethostname
sendto
setsockopt
WSAIoctl
__WSAFDIsSet
select
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
socket
freeaddrinfo
getaddrinfo
WSAGetLastError
ntohs
getsockopt
getsockname
ioctlsocket
WSAStartup
WSACleanup
getpeername
htons
recvfrom

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

wldap32

ord143
ord46
ord211
ord60
ord45
ord50
ord41
ord26
ord27
ord301
ord32
ord33
ord35
ord79
ord30
ord200
ord22

iphlpapi

GetAdaptersInfo

wininet

InternetTimeToSystemTimeA

oleaut32

VariantClear

Exports

Exports

addFPInfo
getUTDID
initAUDID
saveFPInfo
setAppName
setAppkeyAndSecret

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 538KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

084ed7ff10215550169314ae666636a9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

crypt32

wldap32

iphlpapi

wininet

oleaut32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 538KB - Virtual size: 538KB

.data Size: 32KB - Virtual size: 57KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 90KB - Virtual size: 90KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 538KB - Virtual size: 538KB

.data
Size: 32KB - Virtual size: 57KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 90KB - Virtual size: 90KB