7db3f6ab6b9e4b61b100e0cc75f36cb5

Sharing

Copy URL Twitter E-mail

General

Target

7db3f6ab6b9e4b61b100e0cc75f36cb5
Size

162KB
MD5

7db3f6ab6b9e4b61b100e0cc75f36cb5
SHA1

26761e719ee774683da891ef81224e7affef9527
SHA256

18be29a9019d3f5923be9f0e1d92183d8b721cc4cceebf26ad0992a31be2e56f
SHA512

e3ee7c78a13a226287cdb498e7a44260e263ca0c97f566cae8dd4abb65bcf3dcde53d8d1e271e8a6824a8675190c912ddcede859da648b9416d90c86ea58af3d
SSDEEP

3072:ernHuty4kypCUjonEEYdZnBxPIHJdeA4v4/s7JIRW:eT6y4hOEVBd8deA7c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7db3f6ab6b9e4b61b100e0cc75f36cb5

Files

7db3f6ab6b9e4b61b100e0cc75f36cb5
.dll regsvr32 windows:5 windows x86 arch:x86

85a4883e0fbbcb1436b895407998d8ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
CreateProcessW
GetWindowsDirectoryW
GetStartupInfoW
lstrcmpiW
GetProcAddress
GetModuleHandleW
LoadLibraryW
lstrcpyW
lstrlenW
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
lstrcmpW
HeapAlloc
HeapFree
GetProcessHeap
Sleep
FormatMessageW
LocalFree
WaitForSingleObject
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetVersionExW
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
ResetEvent
GetModuleFileNameW
lstrlenA
MultiByteToWideChar
InterlockedCompareExchange
CreateEventW
CreateThread
CloseHandle
SetEvent
InterlockedExchange
GetLastError
ExitThread

msvcrt

iswdigit
wcstombs
strtoul
??3@YAXPAX@Z
_initterm
_adjust_fdiv
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CxxFrameHandler
free
wcslen
_purecall
realloc
malloc
??2@YAPAXI@Z
_snwprintf
_memicmp
wcsncpy
wcsncmp
wcscmp
towlower
_except_handler3
isdigit
wcsstr
_wcsicmp
wcstol
_CxxThrowException
wcscpy
?terminate@@YAXXZ

msvcp60

??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAG0@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

atl

ord32
ord18
ord57
ord23
ord15
ord58
ord16
ord30
ord21

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoSetProxyBlanket

oleaut32

VariantInit
LoadRegTypeLi
SafeArrayGetElement
VariantChangeType
SysAllocStringByteLen
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysFreeString

user32

PostThreadMessageW
wsprintfW
LoadStringW

ws2_32

gethostbyname
connect
htons
inet_addr
WSACleanup
WSAStartup
socket
gethostbyaddr
inet_ntoa
closesocket

iphlpapi

IcmpSendEcho2
IcmpCloseHandle
IcmpCreateFile

framedyn

?GetSYSTEMTIME@WBEMTime@@QBEHPAU_SYSTEMTIME@@@Z
??4WBEMTime@@QAEABV0@QAG@Z

wininet

InternetQueryOptionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitHelperDll

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85a4883e0fbbcb1436b895407998d8ff

Headers

File Characteristics

Imports

kernel32

msvcrt

msvcp60

atl

ole32

oleaut32

user32

ws2_32

iphlpapi

framedyn

wininet

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 59KB

.data Size: 69KB - Virtual size: 72KB

.rsrc Size: 27KB - Virtual size: 26KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 60KB - Virtual size: 59KB

.data
Size: 69KB - Virtual size: 72KB

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 5KB - Virtual size: 4KB