3f968ab7ac50ff67e8d711f9cfdaf20d

Sharing

Copy URL Twitter E-mail

General

Target

3f968ab7ac50ff67e8d711f9cfdaf20d
Size

179KB
MD5

3f968ab7ac50ff67e8d711f9cfdaf20d
SHA1

27b32a275000b0fffbb8830781351ef85e3aa4c1
SHA256

e988f39bc1bfb6edf70821565e7d3083d2814f25b748b265c2b6cb3601779ab1
SHA512

3bc714b7280ed65c3a1eefbe6c532b19e7090952b32bd3bb028cb19de3ce5b93ec797389f117494240ff69bbd1c73513f0f51c8d5891a089316650fc72b529ee
SSDEEP

3072:CRTNNn2uGeRzoLFMfdMql5JmMe64XCTfWKsXm7p5WLzK:oNNn28zoLFMfbl+Me64qb0e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f968ab7ac50ff67e8d711f9cfdaf20d

Files

3f968ab7ac50ff67e8d711f9cfdaf20d
.dll regsvr32 windows:5 windows x86 arch:x86

5c579d7ab37cf3dd1147719019d6bb37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
lstrcmpW
MulDiv
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
WaitForSingleObject
CreateThread
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
ReadFile
SetEndOfFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
InterlockedDecrement
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
CloseHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
InterlockedIncrement
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
GetLocalTime
GetTempPathA
lstrcatA
GetModuleFileNameW
lstrlenA
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrcpyW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
Sleep
HeapReAlloc
HeapDestroy
HeapCreate
GetCommandLineA
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
lstrcatW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar

user32

CharNextW
SetWindowLongW
DestroyWindow
MoveWindow
SendMessageW
GetClassInfoExW
LoadCursorW
GetWindow
IsWindow
GetClassNameA
GetWindowLongW
wsprintfA
DefWindowProcW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateWindowExW
RegisterClassExW
RegisterWindowMessageW
CallWindowProcW
GetClientRect
BringWindowToTop
UpdateWindow
ShowWindow
UnregisterClassA
FindWindowA
CreateAcceleratorTableW
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
SetWindowPos
GetSysColor

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegOpenKeyA

ole32

CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

shell32

ShellExecuteA

oleaut32

OleCreateFontIndirect
LoadRegTypeLi
SysStringLen
SysFreeString
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysAllocStringLen

shlwapi

StrStrIA
StrStrIW
StrChrA

gdi32

GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
DeleteObject
SelectObject

ws2_32

gethostbyname
recv
send
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
closesocket

netapi32

Netbios

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c579d7ab37cf3dd1147719019d6bb37

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

ws2_32

netapi32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 9KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 120KB - Virtual size: 120KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 9KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 12KB