4648c11f0e755065cf81cdc09a933f2b

Sharing

Copy URL Twitter E-mail

General

Target

4648c11f0e755065cf81cdc09a933f2b
Size

443KB
MD5

4648c11f0e755065cf81cdc09a933f2b
SHA1

e89a5be3f13091a98723966efca353a19bfd2406
SHA256

b63193556a471c27f449e23dea7e393d689c8ea5ce2267d8e691aa8da78d239b
SHA512

c11cd1bb17d6091d6329ac82e1ad5d3642ea8f7921ad57c649412be29d30b9ee7f9d28e1e7b4517c985854206de9996ae773211abeb8fc1dadfc3994fb86776f
SSDEEP

12288:RRz/azNQO15sNsjlNBVF9uZj/5ANkSD5O:RRz/2C6+B/5AC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4648c11f0e755065cf81cdc09a933f2b

Files

4648c11f0e755065cf81cdc09a933f2b
.dll windows:6 windows x86 arch:x86

4028328557669218c3e09adaca7c1802

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

floor
_CIsin
free
malloc
_XcptFilter
_controlfp
ceil
_CIlog
_initterm
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_aligned_free
_aligned_malloc
memmove
_CIlog10
memcpy
_isnan
_CItan
_CIpow
_CIcos
_ftol2
__CxxFrameHandler3
memset
_ftol2_sse
_CIsqrt
_CIatan2
_amsg_exit
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_vsnprintf
_vsnwprintf

kernel32

GetTickCount
QueryPerformanceCounter
WaitForSingleObject
ResetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
InterlockedCompareExchange64
OutputDebugStringA
GetThreadTimes
CloseHandle
GetFullPathNameW
GetModuleFileNameW
GetModuleHandleW
lstrcmpiW
GetFileSize
SetFilePointer
ReadFile
CreateFileW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
DuplicateHandle
GetCurrentProcess
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenA
lstrlenW
lstrcmpW
LoadLibraryW
ReleaseMutex
QueryPerformanceFrequency
DisableThreadLibraryCalls
CreateMutexW
GetCurrentThreadId
GetCurrentProcessId
LocalFree
GetSystemPowerStatus
InitializeCriticalSection
LeaveCriticalSection
SetEvent
EnterCriticalSection
InterlockedIncrement
DeleteCriticalSection
InterlockedDecrement
SetThreadPriority
GetCurrentThread
CreateThread
CreateEventW
WaitForMultipleObjects
Sleep
ReleaseSemaphore
OpenProcess
GetExitCodeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
MulDiv
InterlockedExchange
SwitchToThread
InterlockedCompareExchange
GetProcessHeap
GetSystemInfo
HeapSize
CreateSemaphoreW
GetProcessTimes

user32

GetParent
CharUpperW
GetWindowPlacement
IsWindow
GetWindowThreadProcessId
LoadStringW
GetForegroundWindow

advapi32

GetTraceEnableLevel
RegOpenKeyExA
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExA
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
RegCreateKeyA
GetTraceEnableFlags
RegCloseKey
RegSetValueExW
RegSetValueExA
RegQueryValueExW

ole32

CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateInstance
CLSIDFromString
PropVariantClear
CoTaskMemFree

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime
waveOutGetDevCapsW
waveOutGetNumDevs
waveInGetNumDevs
waveInGetDevCapsW

powrprof

PowerReadACValue
PowerGetActiveScheme
CallNtPowerInformation
PowerReadDCValue

Exports

Exports

DirectSoundCaptureCreate
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCaptureEnumerateW
DirectSoundCreate
DirectSoundCreate8
DirectSoundEnumerateA
DirectSoundEnumerateW
DirectSoundFullDuplexCreate
DllCanUnloadNow
DllGetClassObject
GetDeviceID

Sections

.text
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 454KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4028328557669218c3e09adaca7c1802

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

winmm

powrprof

Exports

Exports

Sections

.text Size: 415KB - Virtual size: 415KB

RT_CODE Size: 512B - Virtual size: 284B

.data Size: 13KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 10KB - Virtual size: 454KB

.text
Size: 415KB - Virtual size: 415KB

RT_CODE
Size: 512B - Virtual size: 284B

.data
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 10KB - Virtual size: 454KB