71122095f43eea98481bfc42a0db8705

Sharing

Copy URL

Twitter E-mail

General

Target

71122095f43eea98481bfc42a0db8705
Size

311KB
MD5

71122095f43eea98481bfc42a0db8705
SHA1

57830ec7e62c3a20238809edf5638c1f3749b9df
SHA256

21d36bf1f57fdc4785a9c051f17ef837d15fe583dce53361cd2e6b3fb9ad0519
SHA512

d27b3a0bd5a2bf2466f2f272e84c50e0b5e9fa5d740c11b8c0428dde16832f04ed2d48576854c108b6734d1c84db6c614c528e0a68ce8f7f25bf217d13478f3c
SSDEEP

3072:EXAb6pLQdh+IXSSyDYl1yJksNqJp5AMoejrdVQPIL1Aml5Oy6L0ZaemDti9hBWWC:E+6pXIiSyssepKer2Zml4y6Ms4HoBV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71122095f43eea98481bfc42a0db8705

Files

71122095f43eea98481bfc42a0db8705
.dll regsvr32 windows:4 windows x86 arch:x86

cf62afd0ca781f056a8ef091a8d1c54a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

UnregisterClassA
CreateWindowExA
GetWindowLongA
SetWindowLongA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetActiveWindow
GetFocus
GetSystemMetrics
ShowWindow
wsprintfA
SetForegroundWindow
SetActiveWindow
SetFocus
BeginPaint
SetTimer
KillTimer
CreateAcceleratorTableA
IsWindow
GetDesktopWindow
GetWindow
DestroyAcceleratorTable
CharNextA
EndPaint
CallWindowProcA
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
SetWindowPos
MoveWindow
GetSysColor
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DefWindowProcA
SendMessageA
DestroyWindow

advapi32

RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
VariantInit
VariantClear
DispCallFunc
LoadRegTypeLi
SysAllocStringLen
SysStringByteLen
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString

gdi32

SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
GetDeviceCaps
CreateSolidBrush
GetObjectA
GetStockObject
DeleteObject

kernel32

GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetCurrentDirectoryA
GetFullPathNameA
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetCommandLineA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
QueryPerformanceCounter
GetTickCount
GetStringTypeA
GetStringTypeW
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
RtlUnwind
VirtualQuery
GetSystemInfo
GetSystemTimeAsFileTime
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
HeapFree
InterlockedCompareExchange
GetVersionExA
GetLocaleInfoA
GetACP
InterlockedExchange
LocalFree
CreateFileA
SetFilePointer
ReadFile
GetProcessHeap
HeapAlloc
VirtualFree
IsBadReadPtr
VirtualAlloc
GetTempPathA
CreateProcessA
CloseHandle
WaitForSingleObject
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
SetEndOfFile
CompareStringA
CompareStringW
VirtualProtect
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
lstrcmpiA
SetEnvironmentVariableA
LockResource
SizeofResource
GetCurrentThreadId
LoadResource
FindResourceA
GetProcessId
DisableThreadLibraryCalls
GetModuleFileNameA
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
GetProcAddress
LoadLibraryA
FreeLibrary
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
Sleep
lstrcmpA
CreateThread
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
MulDiv
SetLastError

shlwapi

StrStrIA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf62afd0ca781f056a8ef091a8d1c54a

Headers

File Characteristics

Imports

user32

advapi32

oleaut32

ole32

gdi32

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 228KB - Virtual size: 227KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 24KB - Virtual size: 29KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 24KB - Virtual size: 20KB

.text
Size: 228KB - Virtual size: 227KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 24KB - Virtual size: 29KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 24KB - Virtual size: 20KB