0fabd9027190adc15b2ea019e9967fac

Sharing

Copy URL Twitter E-mail

General

Target

0fabd9027190adc15b2ea019e9967fac
Size

61KB
MD5

0fabd9027190adc15b2ea019e9967fac
SHA1

1b48b165f0bc3b8ed330aa30dd7cb2f7de2eedad
SHA256

e13bb14f45d1ead836f81fdeee1ae4cb51d6364004278991d83996f0edfea366
SHA512

a9508d66a86676567a9ab2a0b4dfbdb925553030950929b6db9d539d6a8a774aeef4746fc46845213594bc91fbe9a00a97d8c1e6664ac4bfcd23e92d7f06735a
SSDEEP

768:jriITiJD+Iw9BlqZDedWDo9A18TpAohqw4CsooldAJ:jrhmJ7YBiDx6y8TKm7sndc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fabd9027190adc15b2ea019e9967fac

Files

0fabd9027190adc15b2ea019e9967fac
.dll windows:5 windows x86 arch:x86

c35aac5ed26ec498ffad0b3d7f76a8c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

_lclose
_llseek
_lopen
WriteTapemark
lstrcmpi
WritePrivateProfileSectionW
WritePrivateProfileSectionA
WriteFileGather
WriteFileEx
WriteFile
WriteConsoleOutputCharacterA
WriteConsoleOutputA
VirtualFreeEx
VerifyVersionInfoW
UpdateResourceW
UnlockFile
TryEnterCriticalSection
SystemTimeToTzSpecificLocalTime
Sleep
SignalObjectAndWait
SetWaitableTimer
SetVolumeMountPointW
SetTapeParameters
SetLocalTime
SetHandleCount
SetFileAttributesW
SetErrorMode
SetConsoleTitleW
SetConsoleDisplayMode
SetConsoleActiveScreenBuffer
ResetEvent
ReleaseMutex
ReadConsoleW
QueryPerformanceCounter
QueryInformationJobObject
QueryDosDeviceW
Process32NextW
PeekConsoleInputW
PeekConsoleInputA
OpenSemaphoreA
OpenEventA
LocalHandle
LocalFileTimeToFileTime
IsDBCSLeadByteEx
HeapDestroy
GlobalHandle
GetTickCount
GetThreadLocale
GetTempPathW
GetTempFileNameA
GetTapePosition
GetSystemTimeAdjustment
GetSystemTime
GetSystemInfo
GetStartupInfoW
GetProcessVersion
GetProcessShutdownParameters
GetPrivateProfileStringA
GetPrivateProfileSectionW
GetDriveTypeW
GetDiskFreeSpaceA
GetCurrentThreadId
GetCurrentDirectoryW
GetCurrencyFormatA
GetComputerNameW
GetComputerNameExA
GetCompressedFileSizeA
GetAtomNameW
FindFirstVolumeMountPointW
FindFirstVolumeA
FindFirstFileExA
FindAtomW
EscapeCommFunction
EnumTimeFormatsA
CreateFileW
EnumResourceNamesA
EnumCalendarInfoA
DnsHostnameToComputerNameW
DisableThreadLibraryCalls
DeleteFileA
DefineDosDeviceW
CreateTimerQueue
CreateNamedPipeA
CreateEventW
CreateEventA
CreateDirectoryExW
ContinueDebugEvent
CompareStringW
CommConfigDialogA
CallNamedPipeW
Beep
AreFileApisANSI
AllocConsole
GetProcAddress
LoadLibraryA
GetProcessHeap
GetWindowsDirectoryW
lstrcatW
lstrcmpW

user32

DragDetect
DispatchMessageA
DestroyMenu
DefMDIChildProcW
DefFrameProcA
DdeSetQualityOfService
DdeQueryStringW
DdeNameService
DdeCreateStringHandleW
DdeAbandonTransaction
CreatePopupMenu
CreateIconFromResourceEx
CreateIconFromResource
CreateDialogParamW
CopyAcceleratorTableA
CheckRadioButton
CharUpperA
CharToOemBuffA
CharLowerBuffW
CallWindowProcW
CallWindowProcA
CallMsgFilterA
BroadcastSystemMessageW
BroadcastSystemMessageA
BeginPaint
DragObject
DrawFocusRect
DrawStateA
DrawTextA
EnableMenuItem
EndDialog
EnumClipboardFormats
EnumDesktopsA
EnumPropsA
FlashWindow
GetCapture
GetCaretPos
GetClassInfoW
GetClassLongW
GetClassNameA
GetClipCursor
GetClipboardFormatNameA
GetClipboardViewer
GetCursor
GetFocus
GetListBoxInfo
GetMenuItemCount
GetMenuItemRect
GetMenuStringA
GetScrollPos
GetThreadDesktop
GetWindowDC
GetWindowPlacement
GetWindowThreadProcessId
IMPQueryIMEW
InflateRect
InsertMenuW
IsWindow
KillTimer
LoadCursorFromFileW
LoadIconW
LoadImageA
LoadKeyboardLayoutA
LoadMenuA
MapVirtualKeyExA
MapVirtualKeyW
MapWindowPoints
MsgWaitForMultipleObjects
OpenInputDesktop
PackDDElParam
PeekMessageA
RedrawWindow
RegisterClassExA
RegisterHotKey
SendInput
SendMessageA
SetActiveWindow
SetCaretPos
SetClassWord
SetKeyboardState
SetMenu
VkKeyScanExA
UnregisterDeviceNotification
UnregisterClassW
UnhookWindowsHook
TranslateMDISysAccel
TrackMouseEvent
SystemParametersInfoA
SwitchToThisWindow
SetWindowPos
SetPropA
SetMenuItemInfoA

gdi32

FlattenPath
AbortPath
AngleArc
Arc
CheckColorsInGamut
ColorCorrectPalette
CreateBitmap
CreateBitmapIndirect
CreateColorSpaceA
CreatePolyPolygonRgn
EngAssociateSurface
EngCreateBitmap
EngDeletePath
EngFillPath
EngStretchBlt
EngStrokePath
EngUnlockSurface
EnumObjects
ExcludeClipRect
ExtEscape
ExtFloodFill
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pxoGetXform
FixBrushOrgEx
GdiAddGlsRecord
GdiCleanCacheDC
GdiConsoleTextOut
GdiConvertMetaFilePict
GdiConvertPalette
GdiConvertRegion
GdiCreateLocalMetaFilePict
GdiEntry3
GdiEntry7
GdiGetLocalBrush
GdiGetSpoolMessage
GdiPrinterThunk
GdiProcessSetup
GdiQueryFonts
GdiQueryTable
GdiReleaseLocalDC
GdiSwapBuffers
GetBrushOrgEx
GetCharABCWidthsI
GetColorSpace
GetDCOrgEx
GetDIBits
GetDeviceGammaRamp
GetEnhMetaFilePixelFormat
GetGlyphIndicesA
GetGlyphOutline
GetLogColorSpaceW
GetMetaFileBitsEx
GetMetaRgn
GetMiterLimit
GetObjectType
GetStockObject
GetTextCharsetInfo
GetTextExtentPointA
GetTextExtentPointI
GetTextMetricsA
IntersectClipRect
InvertRgn
NamedEscape
PATHOBJ_bEnum
PaintRgn
PlayMetaFile
PolyBezier
PolyTextOutA
PolyTextOutW
QueryFontAssocStatus
RealizePalette
Rectangle
RemoveFontMemResourceEx
RemoveFontResourceA
RemoveFontResourceExW
RemoveFontResourceTracking
ResetDCA
STROBJ_dwGetCodePage
SetBitmapDimensionEx
SetEnhMetaFileBits
SetMapMode
SetMapperFlags
SetMiterLimit
SetTextColor
SetWinMetaFileBits
SetWindowOrgEx
SwapBuffers
UpdateColors
UpdateICMRegKeyA
WidenPath
XLATEOBJ_cGetPalette
XLATEOBJ_iXlate
AbortDoc

shell32

SHGetDiskFreeSpaceExA
ShellExecuteW
ShellExecuteExW
ShellExecuteExA
ShellExecuteEx
ShellAboutW
ShellAboutA
SHQueryRecycleBinW
SHPathPrepareForWriteA
SHLoadNonloadedIconOverlayIdentifiers
SHLoadInProc
SHInvokePrinterCommandA
CheckEscapesW
CommandLineToArgvW
DoEnvironmentSubstA
DragAcceptFiles
DragFinish
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
DuplicateIcon
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractIconA
ExtractIconExA
ExtractIconExW
FindExecutableW
SHAppBarMessage
SHBindToParent
SHBrowseForFolder
SHBrowseForFolderA
SHCreateDirectoryExW
SHCreateProcessAsUserW
SHEmptyRecycleBinA
SHEmptyRecycleBinW
SHFileOperationA
SHFileOperationW
SHGetDataFromIDListA
SHGetDataFromIDListW
SHGetSpecialFolderPathW
SHGetFileInfo
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetFolderPathW
SHGetIconOverlayIndexA
SHGetIconOverlayIndexW
SHGetInstanceExplorer
SHGetMalloc
SHGetPathFromIDList
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
Shell_NotifyIcon

ole32

CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoQueryReleaseObject
CoRegisterMessageFilter
CoResumeClassObjects
CoSetCancelObject
CoSuspendClassObjects
CoTaskMemFree
CoUninitialize
CreateBindCtx
CreateDataAdviseHolder
CreateOleAdviseHolder
CreateStdProgressIndicator
DllGetClassObjectWOW
FreePropVariantArray
GetClassFile
GetConvertStg
GetHGlobalFromILockBytes
GetHGlobalFromStream
HACCEL_UserFree
HACCEL_UserMarshal
HBITMAP_UserSize
HBRUSH_UserFree
HBRUSH_UserMarshal
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HENHMETAFILE_UserFree
HICON_UserUnmarshal
HMENU_UserMarshal
HMETAFILEPICT_UserMarshal
HMETAFILEPICT_UserSize
HMETAFILEPICT_UserUnmarshal
HMETAFILE_UserFree
HMETAFILE_UserMarshal
HWND_UserFree
HWND_UserSize
OleCreate
OleCreateEmbeddingHelper
OleCreateFromFile
OleCreateFromFileEx
OleCreateLinkFromData
OleCreateLinkToFile
OleCreateStaticFromData
OleDoAutoConvert
OleGetAutoConvert
OleIsRunning
OleLoad
OleLoadFromStream
OleMetafilePictFromIconAndLabel
OleRegEnumFormatEtc
OleRegEnumVerbs
OleRegGetMiscStatus
OleSetClipboard
OleUninitialize
ProgIDFromCLSID
PropStgNameToFmtId
PropVariantCopy
ReadFmtUserTypeStg
ReleaseStgMedium
SNB_UserMarshal
SetConvertStg
StgConvertPropertyToVariant
StgConvertVariantToProperty
StgGetIFillLockBytesOnFile
UtGetDvtd32Info
WriteOleStg
CoLoadLibrary
CoIsOle1Class
CoInitializeWOW
CoImpersonateClient
CoGetObject
CoGetMarshalSizeMax
CoEnableCallCancellation
CoDosDateTimeToFileTime
CoDeactivateObject
CoCreateInstanceEx
CLIPFORMAT_UserUnmarshal
CoGetCallContext

shlwapi

StrChrIA
StrChrIW
StrChrW
StrCmpNA
StrCmpNIA
StrCmpNW
StrRChrA
StrRChrIA
StrRStrIW
StrStrIA
StrStrIW

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kiii1
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kiii2
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kiii3
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kiii4
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c35aac5ed26ec498ffad0b3d7f76a8c1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

shlwapi

Sections

.text Size: 34KB - Virtual size: 34KB

.data Size: 512B - Virtual size: 588B

kiii1 Size: 5KB - Virtual size: 4KB

kiii2 Size: 5KB - Virtual size: 4KB

.kiii3 Size: 5KB - Virtual size: 4KB

.kiii4 Size: 5KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 512B - Virtual size: 588B

kiii1
Size: 5KB - Virtual size: 4KB

kiii2
Size: 5KB - Virtual size: 4KB

.kiii3
Size: 5KB - Virtual size: 4KB

.kiii4
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB