09e932f6818b16ff75f63cab224ca72a

Sharing

Copy URL Twitter E-mail

General

Target

09e932f6818b16ff75f63cab224ca72a
Size

108KB
MD5

09e932f6818b16ff75f63cab224ca72a
SHA1

d76a077b5cbbd15c83e82e9548421d858c7897c9
SHA256

3a03b85e5b34a8aff9e863b0ff9c7ab44a0f1eb2ab6074839e181d1e3f6dc323
SHA512

2f06274e320263c843aeddbbbd089e2e3d1df858b89803d3808662685205be10de1de40e7cfb910b48b8164c6fcd1f2f27f0e12590c71d152922fe1d898e0e6c
SSDEEP

3072:lolFy+2D5FT+lhQ9LMBeAGFnQ8OkXi/mh2m5sHhF:lolFyNKLQ9LSeAIqmh2m5sHf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09e932f6818b16ff75f63cab224ca72a

Files

09e932f6818b16ff75f63cab224ca72a
.dll windows:5 windows x86 arch:x86

510bd9e4f08ca60962d8b0ab29036b12

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

SendMessageW
wsprintfW
GetClassInfoW
GetFocus
User32InitializeImmEntryTable
CharUpperW
UnloadKeyboardLayout
LoadBitmapW
ReleaseDC
GetDC
GetClientRect
SetWindowLongW
GetWindowLongW
DrawTextExW
GetWindowRect
GetSystemMetrics
MessageBeep
SetCapture
ScreenToClient
GetCursorPos
SetCursor
LoadCursorW
SendMessageTimeoutW
GetDesktopWindow
IsWindowUnicode
CharNextW
CharNextA
MapWindowPoints
GetForegroundWindow
ClientToScreen
GetKeyboardState
ToUnicode
ToAsciiEx
DestroyWindow
MapVirtualKeyW
CreateWindowExW
ShowWindow
UpdateWindow
MonitorFromWindow
GetMonitorInfoW
SystemParametersInfoW
GetClassInfoExW
LoadIconW
RegisterClassExW
GetParent
GetCapture
DrawEdge
BeginPaint
EndPaint
InvalidateRect
DefWindowProcW
ReleaseCapture
SetWindowPos
GetWindow
LoadKeyboardLayoutW
GetWindowThreadProcessId
GetKeyboardLayoutList
SendMessageA
PostMessageW
PostMessageA
WCSToMBEx
GetKeyboardLayout
IsWindow
keybd_event

ntdll

RtlUnwind
RtlIsThreadWithinLoaderCallout
RtlDllShutdownInProgress
RtlUnicodeToMultiByteSize
wcstol
_wcsicmp
wcsncpy
RtlIntegerToUnicodeString
wcscat
RtlUnicodeStringToInteger
wcscpy
RtlDeleteCriticalSection
NtQuerySystemInformation
RtlEnterCriticalSection
RtlLeaveCriticalSection
wcslen
RtlInitializeCriticalSection
NtQueryVirtualMemory

kernel32

IsBadWritePtr
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
lstrcmpiW
CreateThread
Sleep
TlsGetValue
TlsSetValue
TlsAlloc
OpenFileMappingW
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetLastError
lstrlenA
IsDBCSLeadByte
GetProfileIntW
lstrcmpW
SetLastError
lstrcpynW
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
InterlockedDecrement
GetLocaleInfoW
HeapAlloc
LocalSize
LocalReAlloc
LocalFlags
LocalUnlock
LocalLock
GetFullPathNameW
lstrlenW
OpenFile
_lclose
GetThreadLocale
GetSystemDirectoryW
LocalAlloc
GetACP
FreeLibrary
BaseCheckAppcompatCache
GetModuleHandleW
LoadLibraryW
GetProcAddress
MultiByteToWideChar
HeapFree
InterlockedIncrement
GetCurrentThreadId
WideCharToMultiByte
LocalFree
IsDBCSLeadByteEx
GetSystemDefaultLCID

gdi32

CreateFontIndirectW
GetObjectW
CreateDCW
GetTextExtentPoint32W
SetBkColor
CreateCompatibleBitmap
GetDIBits
CreateDIBitmap
TranslateCharsetInfo
PatBlt
Rectangle
SelectObject
GetStockObject
BitBlt
DeleteObject
DeleteDC
CreateCompatibleDC
GetTextMetricsW
ExtTextOutW

advapi32

CheckTokenMembership
FreeSid
RegCreateKeyW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
AllocateAndInitializeSid

Exports

Exports

CtfAImmActivate
CtfAImmDeactivate
CtfAImmIsIME
CtfImmCoUninitialize
CtfImmDispatchDefImeMessage
CtfImmEnterCoInitCountSkipMode
CtfImmGenerateMessage
CtfImmGetGuidAtom
CtfImmHideToolbarWnd
CtfImmIsCiceroEnabled
CtfImmIsCiceroStartedInThread
CtfImmIsGuidMapEnable
CtfImmIsTextFrameServiceDisabled
CtfImmLastEnabledWndDestroy
CtfImmLeaveCoInitCountSkipMode
CtfImmRestoreToolbarWnd
CtfImmSetAppCompatFlags
CtfImmSetCiceroStartInThread
CtfImmTIMActivate
GetKeyboardLayoutCP
ImmActivateLayout
ImmAssociateContext
ImmAssociateContextEx
ImmCallImeConsoleIME
ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmCreateSoftKeyboard
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmDisableIME
ImmDisableIme
ImmDisableTextFrameService
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeA
ImmEscapeW
ImmFreeLayout
ImmGenerateMessage
ImmGetAppCompatFlags
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMCLockCount
ImmGetIMEFileNameA
ImmGetIMEFileNameW
ImmGetImeInfoEx
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmIMPGetIMEA
ImmIMPGetIMEW
ImmIMPQueryIMEA
ImmIMPQueryIMEW
ImmIMPSetIMEA
ImmIMPSetIMEW
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLoadIME
ImmLoadLayout
ImmLockClientImc
ImmLockIMC
ImmLockIMCC
ImmLockImeDpi
ImmNotifyIME
ImmPenAuxInput
ImmProcessKey
ImmPutImeMenuItemsIntoMappedFile
ImmReSizeIMCC
ImmRegisterClient
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSendIMEMessageExA
ImmSendIMEMessageExW
ImmSendMessageToActiveDefImeWndW
ImmSetActiveContext
ImmSetActiveContextConsoleIME
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmSystemHandler
ImmTranslateMessage
ImmUnlockClientImc
ImmUnlockIMC
ImmUnlockIMCC
ImmUnlockImeDpi
ImmUnregisterWordA
ImmUnregisterWordW
ImmWINNLSEnableIME
ImmWINNLSGetEnableStatus
ImmWINNLSGetIMEHotkey

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ss32
Size: 1024B - Virtual size: 846B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

510bd9e4f08ca60962d8b0ab29036b12

Headers

File Characteristics

Imports

user32

ntdll

kernel32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 82KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 3KB - Virtual size: 3KB

.ss32 Size: 1024B - Virtual size: 846B

.text
Size: 83KB - Virtual size: 82KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 3KB - Virtual size: 3KB

.ss32
Size: 1024B - Virtual size: 846B