0974d4c87f5f4a0fccf6fa3f2b5f66a3

Sharing

Copy URL Twitter E-mail

General

Target

0974d4c87f5f4a0fccf6fa3f2b5f66a3
Size

979KB
MD5

0974d4c87f5f4a0fccf6fa3f2b5f66a3
SHA1

b2084281edf58673c4225687c0b6a8c70d6d1c5f
SHA256

a28240128e5173051a0d0b2d88b2c5a4b87fc21e1e5affd69f259078ea007106
SHA512

63dd772969f03e3b12cf801f58699e57ae6bc69809c05d89929532ab25ae11586a7512f59790c57690952ab086ebcb594cb4f0d3a621aebe1c8ee3aef49b5218
SSDEEP

24576:a0w5bt3u3B0vTvP4np4ZFUDDVkFEqIqyKzLYor+ZIbXe1:m5J3uWTvPmp4Z+DVkFEqIqvzUSS+X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0974d4c87f5f4a0fccf6fa3f2b5f66a3

Files

0974d4c87f5f4a0fccf6fa3f2b5f66a3
.dll windows:6 windows x64 arch:x64

749c98435a4cda80fb7e51a5032d9f47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
GetProcessId
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
CreateFileMappingA
GetTempPathA
MoveFileW
Sleep
MultiByteToWideChar
WideCharToMultiByte
FlushConsoleInputBuffer
GetCurrentThreadId
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
CloseHandle
WriteFile
UnlockFileEx
SetFileTime
SetFilePointer
SetEndOfFile
RemoveDirectoryW
ReadFile
LockFileEx
GetFullPathNameW
GetFileSize
GetFileInformationByHandle
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCurrentProcess
GetFileAttributesW
GetDiskFreeSpaceW
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindFirstChangeNotificationW
FindCloseChangeNotification
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableA
GetEnvironmentVariableA
GetStdHandle
BindIoCompletionCallback
RtlCaptureStackBackTrace

gdi32

RectInRegion
GetRegionData
DeleteObject
GdiSetBatchLimit
GdiGetBatchLimit
CreateEllipticRgnIndirect

advapi32

QueryAllTracesW
LsaOpenTrustedDomainByName
LsaOpenPolicy
LsaClose
EnumDependentServicesW
DeleteService
AddAccessDeniedAceEx
PrivilegedServiceAuditAlarmW
FileEncryptionStatusA
GetUserNameW
CloseServiceHandle
CreateServiceW

shell32

SHChangeNotify
ord16
SHGetFolderPathW
ord701

shlwapi

SHRegCreateUSKeyA
AssocQueryKeyW
ord157
UrlCanonicalizeW
UrlHashA
ord156
StrIsIntlEqualA
SHRegDeleteUSValueA

dbghelp

StackWalk64
SymCleanup
SymInitialize
SymSetContext
SearchTreeForFile

imm32

ImmEnumRegisterWordA
ImmGetRegisterWordStyleA
ImmUnregisterWordA
ImmRegisterWordA
ImmSetCandidateWindow
ImmInstallIMEW
ImmGetIMEFileNameW
ImmCreateContext
ImmDestroyContext
ImmGetCompositionStringA
ImmGetImeMenuItemsA
ImmGetCandidateListCountW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetCompositionFontW
ImmGetStatusWindowPos
ImmGetCandidateWindow
ImmSetStatusWindowPos

winmm

joySetThreshold
waveInGetNumDevs
waveInGetID
midiInGetNumDevs
midiInMessage
joyGetNumDevs
mciSendCommandA
mciSendStringA
mciGetDeviceIDA
mciGetErrorStringA
joyGetThreshold
waveInGetErrorTextW
waveOutGetID
waveOutGetErrorTextW
waveOutGetNumDevs
mmioWrite
mmioRead
mmioClose
mmioOpenA

rpcrt4

MesHandleFree
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
MesEncodeFixedBufferHandleCreate
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
I_RpcMapWin32Status

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
strrchr
__std_exception_copy
memset
memmove
memcpy
memcmp
memchr
_CxxThrowException
strchr
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_errno
_initterm
_cexit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_seh_filter_dll

api-ms-win-crt-string-l1-1-0

strncpy
isspace
isxdigit
isdigit
islower
isupper
iscntrl
toupper
tolower
wcsncat
wcsncpy
isprint
isalpha
ispunct
_wcsnicmp
isalnum
strncat
isgraph

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
malloc

api-ms-win-crt-convert-l1-1-0

_ltow
_ultoa
_ultow
_itoa
strtoul
strtol
strtod
atoi
atof
_itow

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-stdio-l1-1-0

fseek
ftell
fwrite
getc
puts
ungetc
__stdio_common_vfprintf
__stdio_common_vfscanf
__stdio_common_vsprintf
__stdio_common_vsscanf
fopen
fgets
ferror
feof
fclose
__acrt_iob_func
fputs
fread

api-ms-win-crt-time-l1-1-0

_get_daylight
_time64
_mktime64
_localtime64
_gmtime64

api-ms-win-crt-math-l1-1-0

exp
log

Exports

Exports

HG_Core_context_set_datas
hg_atomic_queue_frees
hg_core_progress_na_7e3be40s
hg_log_set_stream_errors
stringpool_clone

Sections

.text
Size: 796KB - Virtual size: 796KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

749c98435a4cda80fb7e51a5032d9f47

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

shlwapi

dbghelp

imm32

winmm

rpcrt4

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 796KB - Virtual size: 796KB

.rdata Size: 157KB - Virtual size: 157KB

.data Size: 1KB - Virtual size: 47KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 796KB - Virtual size: 796KB

.rdata
Size: 157KB - Virtual size: 157KB

.data
Size: 1KB - Virtual size: 47KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB