fa6265406d81daa5f9b7b49ac0bdc8da

Sharing

Copy URL Twitter E-mail

General

Target

fa6265406d81daa5f9b7b49ac0bdc8da
Size

228KB
MD5

fa6265406d81daa5f9b7b49ac0bdc8da
SHA1

ba2fc7dc393943c28b2c4c783221fbdb294a18cc
SHA256

e00d1eee126caa7e84afb73f38bcbb43cb2b194126eff534b587ccb9777c5ea5
SHA512

bcfa860155ae92c6fa9a93a003f4892ca1372bd21083792ca2e2af36fdd971c63d429da3a1e3d926f7b48b7e642d9c560718b1cd79be4b454b4316f5db33fbf9
SSDEEP

3072:GzSs+fHiL3bCvG52P/n/xw9e0JJye5xQtqEChxw/I2w:Gzb/CniLWeC04

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa6265406d81daa5f9b7b49ac0bdc8da

Files

fa6265406d81daa5f9b7b49ac0bdc8da
.dll regsvr32 windows:4 windows x86 arch:x86

ac544d5aee87758d9037606aa1ee94fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetThreadPriority
GetCurrentThread
TerminateThread
DuplicateHandle
IsBadReadPtr
VirtualProtect
VirtualAlloc
IsBadCodePtr
VirtualFree
Thread32Next
Thread32First
SetThreadPriority
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
OpenThread
CreateThread
ResetEvent
CreateEventW
SetEvent
FreeLibraryAndExitThread
LoadLibraryW
GetProcAddress
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
ProcessIdToSessionId
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
GetModuleHandleW
LoadLibraryExW
FreeLibrary
lstrcmpiW
GetLastError
DisableThreadLibraryCalls
UnmapViewOfFile
InterlockedExchangeAdd
GetComputerNameW
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetModuleFileNameW
InterlockedExchange
DeleteCriticalSection
LocalFileTimeToFileTime
FileTimeToSystemTime
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
WaitForSingleObject
lstrlenW
CloseHandle
CreateMutexW
CreateToolhelp32Snapshot
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetModuleFileNameA
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
LCMapStringA
HeapCreate
ExitProcess
lstrcpynW
WriteFile
CreateFileW
DeleteFileW
ReadFile
GetFileSize
GetTempFileNameW
CreateMutexA
lstrcpynA
lstrlenA
GetTickCount
WideCharToMultiByte
GetSystemTime
GlobalUnlock
GlobalLock
GlobalSize
GetTempPathW
CreateSemaphoreW
CreateDirectoryW
lstrcatW
lstrcpyW
GetSystemTimeAsFileTime
ReleaseSemaphore
Sleep
GetTimeZoneInformation
SetFilePointer
GlobalAlloc
GlobalFree
GlobalReAlloc
CreateFileA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCommandLineA
GetModuleHandleA

user32

CharLowerBuffW
CharLowerW
GetDesktopWindow
UnregisterClassA
SetTimer
KillTimer
PostThreadMessageW
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
CharNextW

advapi32

RevertToSelf
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
ImpersonateLoggedOnUser
SetNamedSecurityInfoW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegGetKeySecurity
RegOpenKeyW
RegSetKeySecurity
RegQueryValueExW
LookupAccountNameW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
ConvertStringSidToSidW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptDeriveKey
AdjustTokenPrivileges

ole32

CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoUnmarshalInterface
CoTaskMemFree
StringFromCLSID
CreateStreamOnHGlobal
GetHGlobalFromStream
CoMarshalInterThreadInterfaceInStream
CoTaskMemRealloc
CoCreateInstance
CoGetInterfaceAndReleaseStream

oleaut32

SafeArrayCreate
SafeArrayGetElement
SafeArrayPutElement
SafeArrayDestroy
VarBstrCmp
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysStringLen
SysFreeString
VarBstrCat
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysAllocString
SystemTimeToVariantTime
SysAllocStringByteLen
VarUI4FromStr

shlwapi

SHCreateStreamOnFileW
PathStripPathW
PathFileExistsW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSCloseServer
WTSOpenServerW

netapi32

NetApiBufferFree
NetWkstaUserEnum

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac544d5aee87758d9037606aa1ee94fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

netapi32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 20KB - Virtual size: 18KB