1983e40013de8f4b86bc2326103fba45

Sharing

Copy URL Twitter E-mail

General

Target

1983e40013de8f4b86bc2326103fba45
Size

116KB
MD5

1983e40013de8f4b86bc2326103fba45
SHA1

abf641e96245b7d843db7399a0180d178f899da0
SHA256

5a689e49e7e8cb5059b761f0edd6fe498b03b10326fd30e80058af2e451d5a8f
SHA512

b038e94d43501de97173e1a54a6110f4ebd7dd5605e8fc029bb8c0b4acaca2fc4b6b1843f78f7c96dd29f615d6bdd390f8a6ef4b2b7ee0dc8878d4437a0a7eb4
SSDEEP

3072:O52i353FMSxbt7pzaIc8g7gO/HuNsisTaxm:OUEc8UgaLi5c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1983e40013de8f4b86bc2326103fba45

Files

1983e40013de8f4b86bc2326103fba45
.dll windows:4 windows x86 arch:x86

0d3a6c108754803d5f87874dc9d8ac63

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtectEx
OpenSemaphoreW
GetLocaleInfoA
OpenConsoleW
QueryPerformanceCounter
OpenWaitableTimerA
SetEnvironmentVariableA
ReadConsoleOutputA
GetProfileStringA
SetConsoleWindowInfo
CloseConsoleHandle
DosDateTimeToFileTime
GetFileAttributesW
GetCurrentDirectoryA
VirtualProtect
WaitForDebugEvent
WriteConsoleOutputW
GetProcAddress
GetCompressedFileSizeW
FatalAppExitW
SetLocaleInfoA
EnumDateFormatsW
SetConsoleNumberOfCommandsA
SetEndOfFile
Heap32ListFirst
WaitForMultipleObjectsEx
GetProfileIntW
ReadConsoleOutputCharacterW
UnlockFileEx
GetTickCount
GetModuleHandleA
FindFirstFileExA
OpenFile
LocalFree
GetThreadTimes
TlsAlloc
GetNamedPipeHandleStateW
VerLanguageNameW
SetNamedPipeHandleState
SetLastError
GetLocalTime
WriteProfileSectionA
WriteConsoleOutputCharacterW
FreeEnvironmentStringsA
RtlZeroMemory
SetComputerNameW
GlobalHandle
RegisterWowBaseHandlers
GlobalFlags
SetConsoleKeyShortcuts
GetSystemTime
GetPrivateProfileSectionNamesA
SetConsoleScreenBufferSize
CancelWaitableTimer
InitializeCriticalSection
FreeLibrary
SetUnhandledExceptionFilter
SetCommBreak
SetThreadPriorityBoost
GetProcessPriorityBoost
ReadConsoleW
FileTimeToDosDateTime
ExpungeConsoleCommandHistoryA
LocalShrink
SetDefaultCommConfigW
OpenFileMappingA
BackupRead
GetCommModemStatus
GetComputerNameA
CreateMutexA
GlobalDeleteAtom
GetStringTypeW
CreateConsoleScreenBuffer
ReadConsoleOutputCharacterA
DeleteVolumeMountPointW
CreateEventW
CompareStringA
SetSystemTime
GetProcessHeaps
OutputDebugStringA
VerifyConsoleIoHandle
SetSystemTimeAdjustment
ConvertDefaultLocale
GetThreadPriority
VirtualFreeEx
DebugBreak
GetHandleInformation
GetVersion
LoadLibraryA
VirtualAlloc
IsValidLocale

gdi32

GetCharWidthI
TranslateCharsetInfo
CreatePatternBrush
CreateMetaFileA
DescribePixelFormat
SetDIBits
DeleteDC
GdiPlayDCScript
EndPath
GetCharWidthW
CloseFigure
GetColorAdjustment
EqualRgn
FillPath
SetMetaFileBitsEx
UpdateICMRegKeyW
GetMetaRgn
GdiEndPageEMF
StrokeAndFillPath
PolyBezierTo
PatBlt
ExcludeClipRect
EndPage
CopyEnhMetaFileW
GetCharWidthA
CreateRectRgnIndirect
SelectObject
ExtCreateRegion
Arc
CreateScalableFontResourceA
GetGlyphOutlineW
GetTextExtentPointA
IntersectClipRect
ExtTextOutW
GetColorSpace
AbortDoc
GetViewportExtEx
GetTextFaceW
ExtTextOutA
LineTo
CreateCompatibleBitmap
FillRgn
GdiDeleteSpoolFileHandle
GetSystemPaletteUse
GetDeviceCaps
StretchBlt
GetFontUnicodeRanges
ScaleViewportExtEx
CancelDC
SetWindowOrgEx
ScaleWindowExtEx
ColorCorrectPalette
CreateRectRgn
GdiComment
EndDoc
DeviceCapabilitiesExW
SetTextColor
SetBkColor
RemoveFontResourceExW
SetPixelFormat
SetPixelV
GetGlyphIndicesW
SetICMMode
GetRgnBox
GetOutlineTextMetricsW
CombineRgn
CreateFontIndirectW
GetObjectA
CreateCompatibleDC
CreateDIBPatternBrushPt
SetWorldTransform
UpdateICMRegKeyA
GetEnhMetaFileHeader
BeginPath
GetStockObject

advapi32

SetEntriesInAuditListA
CryptGenRandom
RegNotifyChangeKeyValue
RegCreateKeyA
FreeSid
CryptVerifySignatureW
AccessCheck
CryptHashSessionKey
ReadEventLogW
CryptDuplicateHash
StartServiceCtrlDispatcherA
GetTrusteeTypeA
SystemFunction024
QueryServiceObjectSecurity
CryptSetProvParam
AdjustTokenGroups
LsaGetQuotasForAccount
ElfOpenBackupEventLogW
ConvertToAutoInheritPrivateObjectSecurity
LogonUserA
LsaCreateAccount
OpenEventLogA
LsaOpenPolicy
RegDeleteKeyA
RegisterServiceCtrlHandlerA
BuildImpersonateExplicitAccessWithNameW
CryptHashData
GetSecurityDescriptorLength
ImpersonateSelf
OpenServiceW
AccessCheckAndAuditAlarmW
SystemFunction008
GetSidIdentifierAuthority
DuplicateToken
GetFileSecurityW
LookupPrivilegeDisplayNameW
ConvertStringSidToSidW
GetPrivateObjectSecurity
ConvertSidToStringSidW
LsaQueryInfoTrustedDomain
GetSecurityDescriptorSacl
CloseServiceHandle
ChangeServiceConfigW
CryptSetProviderA

opengl32

glRasterPos4s
glTexCoord1dv
glVertex3s
glLightModeli
glGetString
glGetTexGeniv
wglMakeCurrent
glColor4i
glMap2f
glEnableClientState
glTexCoord2s
glGetMaterialfv
glRasterPos3f
glLightfv
glColor4d
glColor4f
glRasterPos3fv
glLoadMatrixd
glGetPolygonStipple
glColor3i
wglSetLayerPaletteEntries
glPixelTransferi
glTexCoord4i
glPixelStorei
glShadeModel
glVertex3d
glEnd
wglUseFontOutlinesW
glVertex4i
glMapGrid2d
glColor3sv
wglGetPixelFormat
glColor4ui
glGetIntegerv
glLighti
glColor3bv
glColor3us
glGetTexGenfv
glDrawElements
glArrayElement
glRectdv
glDepthFunc
glColor3f
glFlush
glColor3ub
wglDeleteContext
wglCreateContext
glMap2d
glLineWidth
glCopyTexImage1D
GlmfEndPlayback
glIsEnabled
glColor3s
glTranslatef
glIndexf
glCallLists
glTexCoord3d
glGetMaterialiv
glPrioritizeTextures
glTexCoord3dv
glMultMatrixd
glLightModelfv

shell32

ExtractIconW
StrCmpNA
SHBrowseForFolderW
FreeIconList
ord179
StrCmpNIA
SHGetSpecialFolderPathW
SHUpdateRecycleBinIcon
ord180
StrChrA
StrStrIW
StrStrA
SHInvokePrinterCommandA
SHFreeNameMappings
DoEnvironmentSubstA
Shell_NotifyIconW
DoEnvironmentSubstW
StrRStrIA
StrRChrA
ExtractIconExA
DuplicateIcon
StrStrW
StrRStrA
StrRChrW
StrRChrIA
CommandLineToArgvW
SheChangeDirExW
SHLoadInProc
SHFileOperationW
SHFileOperationA
SHGetFileInfoW
StrChrW
SHGetDesktopFolder
SHGetMalloc
SHGetSpecialFolderPathA
SHFormatDrive
SheGetDirA
DragQueryFileAorW
StrNCmpA
DragQueryPoint
RegenerateUserEnvironment
ShellHookProc
SHGetDataFromIDListW
ExtractAssociatedIconW
FindExecutableA
SHGetDiskFreeSpaceA
SHGetDataFromIDListA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetInstanceExplorer
SHBrowseForFolderA
ExtractAssociatedIconExA
Shell_NotifyIconA
FindExecutableW
SHAppBarMessage
InternalExtractIconListW
StrChrIA
SHQueryRecycleBinW
ExtractIconExW
StrStrIA
SHGetSettings
StrNCmpW
StrRChrIW
StrCmpNIW
SHEmptyRecycleBinA
StrChrIW
StrNCmpIW
SheSetCurDrive
SHInvokePrinterCommandW
SHAddToRecentDocs
SHEmptyRecycleBinW
DragFinish
ShellAboutW
StrNCmpIA
ExtractAssociatedIconExW
StrRStrIW
DragQueryFileW
DragAcceptFiles
StrCmpNW
ExtractAssociatedIconA
SHGetPathFromIDListW
CheckEscapesW
SHGetFileInfoA
ExtractIconA
ShellAboutA

msvcrt

_mbsicoll
_mbsnbcmp
_mbsspn
_mbsdec
_mbsncoll
_mbsstr
_mbscspn
_mbsninc
_mbsnbcoll
_access
_wrename
_filelengthi64
asin
malloc
strcoll
__lc_codepage
_gcvt
strerror
qsort
fputc
fclose
fputs
_ftime
tmpnam
strcpy
_mbsbtype
_fpclass
fscanf
__p__daylight
_Strftime
_expand
_execlpe
_hypot
__unguarded_readlc_active
_wrmdir
_wunlink
memset
_splitpath
_CIacos
_dup2
fopen
strcmp
fseek
_mbsdup
iswlower
_CIsqrt
__p__wenviron
_tolower
fwrite
__set_app_type
_wcsncoll
_CItanh
fwprintf
_logb
_lsearch
_atoldbl
memchr
isleadbyte
printf
system
_EH_prolog
__crtGetLocaleInfoW
fabs
_cabs
__p___initenv
_strdup
_outpd
__unDName
_findfirst
_initterm
_msize
_mbsnbcat
strtod
fprintf
_tzname
_scalb
_unlock
sprintf
towlower
localtime
_ungetch
_CxxThrowException
_unlink
ferror
iswcntrl
_adjust_fdiv
_getpid
_mbsnset
_i64toa
_mbsncat
_outp
vfprintf
_mbctokata
__p___argv
_creat
fsetpos
getwc
_wspawnlp
feof
ftell
_putws
fread
_i64tow

Exports

Exports

Etlxjel
Hmxk
Jqftdacq
Ncsmkbcxs
Nkgfptvomv
Qzwyj
Sagzd
Tbztsovie
Ygxbodnmcx
Yvavcvlmr

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d3a6c108754803d5f87874dc9d8ac63

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

opengl32

shell32

msvcrt

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 52KB - Virtual size: 50KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 52KB - Virtual size: 50KB

.reloc
Size: 8KB - Virtual size: 5KB