217f2c1d57b74e8702073c0901561f43

Sharing

Copy URL Twitter E-mail

General

Target

217f2c1d57b74e8702073c0901561f43
Size

92KB
MD5

217f2c1d57b74e8702073c0901561f43
SHA1

1b375d7d61124e02c53f83257d5cb689d83b9ddc
SHA256

7de6f5eda596485aee514bd82192757c3ab16f9c9da2b0fd843c6ae119c8b17d
SHA512

543e3319aa7b9ca5d1f9c81e777c13c9312f44b12f77e8ad5b0a9e664d46545524a11a8316d697bf6d922ea31d57231eed8d6c8be0bddb87834ceed7bf9b0641
SSDEEP

1536:YtbChkAApV1lnqToen6An81t8CJliF6NlGSc48cxwDfihuWOneZJ1IsHba:YRYACQ1uC2cc48ewjihuvneZJ17ba

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
217f2c1d57b74e8702073c0901561f43

Files

217f2c1d57b74e8702073c0901561f43
.dll windows:4 windows x86 arch:x86

80876ff98f7473ed2204be064fb12a61

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetLocalTime
MapViewOfFile
CreateFileMappingA
HeapFree
GetProcessHeap
HeapAlloc
UnmapViewOfFile
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
ReleaseMutex
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
lstrcpynA
LocalSize
Process32Next
lstrlenA
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
MoveFileExA
GetSystemDirectoryA
lstrcmpiA
DeviceIoControl
SleepEx
ExitThread
SetEvent
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetProcAddress
LoadLibraryA
InterlockedExchange
CancelIo
lstrcatA
FreeLibrary
GetVersionExA
CreateDirectoryA
GetFileAttributesA
CreateProcessA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
LocalReAlloc
FindFirstFileA
RemoveDirectoryA
CreateFileA
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
SetLastError
WriteFile
ReadFile

ws2_32

connect
htons
gethostbyname
socket
recv
select
send
gethostname
getsockname
inet_addr
WSAIoctl
sendto
WSASocketA
inet_ntoa
closesocket
WSAStartup
WSACleanup
setsockopt

user32

GetCursorInfo
GetCursorPos
ReleaseDC
SetProcessWindowStation
GetDC
SetRect
GetSystemMetrics
GetClipboardData
OpenWindowStationA
ExitWindowsEx
GetWindowThreadProcessId
GetDesktopWindow
IsWindowVisible
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
EnumWindows
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SystemParametersInfoA
SendMessageA
BlockInput
DestroyCursor
LoadCursorA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetKeyNameTextA
GetActiveWindow
GetWindowTextA
CharNextA
wsprintfA
GetInputState
GetForegroundWindow
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
GetThreadDesktop
OpenDesktopA
PostMessageA
CreateWindowExA
CloseWindow
IsWindow
mouse_event
SetThreadDesktop

gdi32

DeleteObject
DeleteDC
CreateDIBSection
GetDIBits
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
SelectObject

advapi32

OpenServiceA
QueryServiceStatus
ControlService
DeleteService
RegOpenKeyExA
RegQueryValueA
RegCloseKey
OpenSCManagerA
CloseServiceHandle
StartServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegSetKeySecurity
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyExA
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

msvcrt

_strcmpi
ceil
_ftol
strstr
memcmp
strchr
malloc
strcmp
strlen
free
strrchr
memmove
strncat
realloc
atoi
wcstombs
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
_except_handler3
??2@YAPAXI@Z
_CxxThrowException
memset
_strnset
_itoa
_strnicmp
strcpy

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

avicap32

capCreateCaptureWindowA

msvfw32

ICSeqCompressFrame
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

AerviceMaio
ServiceMain
servicemain

Sections

.ABCclim
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80876ff98f7473ed2204be064fb12a61

Headers

File Characteristics

Imports

kernel32

ws2_32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

msvcp60

imm32

wininet

avicap32

msvfw32

psapi

Exports

Exports

Sections

.ABCclim Size: 63KB - Virtual size: 63KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 5KB

.ABCclim
Size: 63KB - Virtual size: 63KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 5KB