6d9ac314a52622b79f5f151480451cc6

Sharing

Copy URL

Twitter E-mail

General

Target

6d9ac314a52622b79f5f151480451cc6
Size

252KB
MD5

6d9ac314a52622b79f5f151480451cc6
SHA1

26956423463fa7eace3fd0b5bbf9063577ac8677
SHA256

eb0c36faf16ffc1fc25eb998d789ca29859ff4cce6e666a333bc4cd3a4d889f3
SHA512

ec18fee4cd89a1dedbe5a9a27fff6bd8ae52feef6f0d1966942069245c4e5ed39fd35655753531b72e66c484d9c948f605bd8b2b05b46bdbb0332ddf91e85709
SSDEEP

6144:GxVs7Iv5/20ZHgfuatIvtTBJL/AO34Rf9u2E:DU+DmvtTrLKZQ2E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d9ac314a52622b79f5f151480451cc6

Files

6d9ac314a52622b79f5f151480451cc6
.dll windows:5 windows x86 arch:x86

531c7f5a5907cf925df89ebec9514346

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

inet_ntoa
WSAStartup
select
htons
connect
WSAIoctl
getpeername
getsockname
gethostbyname
closesocket
socket
send
recv
gethostname
ntohs
setsockopt
WSACleanup

wininet

InternetOpenW
InternetReadFile
InternetCloseHandle
InternetOpenUrlW

shlwapi

StrCmpIW
StrStrIW
StrRChrW
StrStrW

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW

winmm

mixerSetControlDetails
mixerGetNumDevs
mixerGetDevCapsW
mixerGetLineInfoW
mixerClose
mixerGetControlDetailsW
waveInStart
mixerGetLineControlsW
waveOutUnprepareHeader
waveInAddBuffer
waveInOpen
waveInPrepareHeader
waveOutReset
waveOutPrepareHeader
waveOutGetNumDevs
waveOutOpen
mixerOpen
waveInUnprepareHeader
waveOutWrite
waveInClose
waveOutClose
waveInReset
waveInGetNumDevs

psapi

GetModuleFileNameExW
EnumProcessModules

userenv

CreateEnvironmentBlock

kernel32

GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
TlsAlloc
GetModuleHandleA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
SetEvent
GetTickCount
Sleep
CreateEventW
CloseHandle
lstrlenW
WideCharToMultiByte
lstrcpyW
ResetEvent
CancelIo
GetFileSize
FindFirstFileW
SetFilePointer
GetDriveTypeW
SetErrorMode
CreateProcessW
GetLogicalDriveStringsW
CreateDirectoryW
WriteFile
FormatMessageW
GetFileAttributesW
ReadFile
CreateFileW
lstrcmpW
GetLastError
MoveFileW
FindClose
RemoveDirectoryW
lstrcatW
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
LocalFree
GetVolumeInformationW
ExitProcess
GetCurrentProcess
TerminateThread
lstrcpynW
GetModuleFileNameW
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
VirtualQuery
GetLocalTime
CreateFileMappingW
OutputDebugStringW
SetUnhandledExceptionFilter
GetModuleHandleW
IsBadWritePtr
FlushFileBuffers
GlobalSize
GlobalLock
InitializeCriticalSection
GlobalAlloc
LeaveCriticalSection
GlobalUnlock
EnterCriticalSection
GlobalFree
DeleteCriticalSection
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
GetEnvironmentVariableW
SetPriorityClass
lstrlenA
GetCurrentThread
SetProcessPriorityBoost
LoadLibraryW
GetVersionExW
GetExitCodeProcess
SetThreadPriority
GetProcAddress
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetShortPathNameW
lstrcpyA
PeekNamedPipe
TerminateProcess
GetStartupInfoW
DisconnectNamedPipe
CreatePipe
ExpandEnvironmentStringsW
OpenProcess
HeapSize
LocalSize
MultiByteToWideChar
GlobalHandle
CreateThread
ExitThread
GetCommandLineA
UnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
CreateFileA
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

user32

GetKeyNameTextW
GetActiveWindow
GetWindowTextW
CallNextHookEx
mouse_event
SetClipboardData
SendMessageW
GetSystemMetrics
OpenClipboard
BlockInput
DestroyCursor
EmptyClipboard
SystemParametersInfoW
GetClipboardData
SetCursorPos
WindowFromPoint
LoadCursorW
SetCapture
SetWindowsHookExW
CloseClipboard
keybd_event
GetCursorPos
GetDesktopWindow
ReleaseDC
SetRect
GetCursorInfo
GetDC
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
PostMessageW
GetThreadDesktop
GetWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
DispatchMessageW
TranslateMessage
GetMessageW
UnhookWindowsHookEx
ExitWindowsEx
CharNextW
wvsprintfW
wsprintfW
GetClientRect
CreateWindowExW
CloseWindow
MapVirtualKeyW

gdi32

BitBlt
DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap

advapi32

DeleteService
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
ControlService
RegisterServiceCtrlHandlerW
SetServiceStatus
QueryServiceStatus
DuplicateTokenEx
StartServiceW
ChangeServiceConfig2W
SetTokenInformation
RegOpenKeyW
CreateProcessAsUserW
EqualSid
RegCreateKeyExW
GetTokenInformation
OpenServiceW
OpenSCManagerW
AllocateAndInitializeSid
CloseServiceHandle
CreateServiceW
GetLengthSid
RegQueryValueExW
RegQueryValueW
RegDeleteValueW
RegOpenKeyExW
FreeSid
AddAccessAllowedAce
RegCloseKey

shell32

ShellExecuteExW
SHChangeNotify
SHGetFileInfoW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString

Exports

Exports

Install
Launch
ServiceMain
UnInstall

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

531c7f5a5907cf925df89ebec9514346

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

shlwapi

imm32

winmm

psapi

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 155KB - Virtual size: 155KB

.rdata Size: 58KB - Virtual size: 58KB

.data Size: 24KB - Virtual size: 50KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 155KB - Virtual size: 155KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 24KB - Virtual size: 50KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 12KB - Virtual size: 12KB