ffddc64fc0ae0bc00cf409b02f8c22db

Sharing

Copy URL Twitter E-mail

General

Target

ffddc64fc0ae0bc00cf409b02f8c22db
Size

332KB
MD5

ffddc64fc0ae0bc00cf409b02f8c22db
SHA1

185316bd5ce58757d5ea641aa2a8fbbe46e19acd
SHA256

8187998a530a343b06466a67445ddad4cc33cd5425e892529a7056eaf7ef3199
SHA512

274aeb921cbe6e54e3270fe512206bf744fe455f928ce3ae90729bd1d193afe285dc6bc9a22fe753909431dd1e8f4df950e801fa375fc4098a10d88cb0686f66
SSDEEP

6144:kv66WfBqqKNkz02Cr89V4x1pk2w2D9tXf39zEW9zlC2btFm:kTqqqKkQ2Ci4d7wMz9gSBb3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffddc64fc0ae0bc00cf409b02f8c22db

Files

ffddc64fc0ae0bc00cf409b02f8c22db
.dll regsvr32 windows:4 windows x86 arch:x86

b7263584176e712755a5df9fa64b8207

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

imagehlp

UnMapAndLoad
MapAndLoad

kernel32

ReadFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileW
GetFullPathNameW
FileTimeToLocalFileTime
GetFileAttributesW
GetFileTime
GetTickCount
RtlUnwind
HeapFree
ExitProcess
HeapAlloc
HeapReAlloc
GetCommandLineA
TerminateProcess
HeapSize
VirtualProtect
VirtualAlloc
HeapCreate
VirtualFree
IsBadWritePtr
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
WritePrivateProfileStringW
FileTimeToSystemTime
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
LoadLibraryW
GetLocaleInfoW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetVersionExA
SetLastError
MulDiv
GlobalLock
GlobalUnlock
FormatMessageW
CreateProcessW
ReleaseMutex
OpenMutexW
CreateMutexW
WaitForSingleObject
lstrcatW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
CreateThread
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
ExitThread
lstrcpynW
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrcpyW
lstrcmpW
DeleteFileW
GetSystemInfo
GetWindowsDirectoryW
GetVolumeInformationW
WriteFile
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
lstrlenA
LocalAlloc
LocalFree
GetEnvironmentVariableW
GetTempFileNameW
VirtualQuery
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
SystemTimeToFileTime
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GlobalAlloc
GlobalFree
HeapDestroy

user32

ValidateRect
SetCursor
PostQuitMessage
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
SetMenuItemBitmaps
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
IsWindowEnabled
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
GetClassInfoExW
GetClassLongW
SendDlgItemMessageW
SendDlgItemMessageA
GetFocus
GetCursorPos
SetFocus
IsChild
GetForegroundWindow
SetActiveWindow
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
LoadIconW
CharUpperW
MapWindowPoints
IsRectEmpty
PostThreadMessageW
RegisterClipboardFormatW
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
MessageBoxW
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
PostMessageW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
GetClassInfoW
TranslateMessage
GetMessageW
MapDialogRect
RegisterClassW
SetWindowContextHelpId
GetSysColorBrush
LoadCursorW
DestroyMenu
IsWindow
GetDlgCtrlID
DefWindowProcW
GetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
CopyRect
PtInRect
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnregisterClassW
ShowWindow
CharNextW
GetParent
GetClientRect
GetWindowRect
BringWindowToTop
SetPropW
GetPropW
CallWindowProcW
SetWindowLongW
RemovePropW
SendMessageW
RealGetWindowClassW
GetClassNameW
EnumChildWindows
GetWindowTextW
wsprintfW
EnableWindow
SetCapture
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
PeekMessageW
SetRect
GetLastActivePopup
DrawTextW

gdi32

GetBkColor
CreateRectRgnIndirect
GetMapMode
GetRgnBox
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetBkColor
SetTextColor
GetClipBox
GetTextColor
GetDeviceCaps
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateBitmap
GetObjectW
SetWindowExtEx

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

CryptAcquireContextW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCreateKeyW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCloseKey

comctl32

ord17

shlwapi

PathFindExtensionW
StrCmpIW
StrStrIW
UrlUnescapeW
UrlGetPartW
PathFindFileNameW
PathStripToRootW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
CLSIDFromProgID
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoCreateInstance
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemFree

oleaut32

VarBstrCmp
SystemTimeToVariantTime
VariantCopy
OleCreateFontIndirect
VariantChangeType
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
RegisterTypeLi
UnRegisterTypeLi
DispCallFunc
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantClear
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarBstrCat
VariantInit

urlmon

UrlMkGetSessionOption
URLDownloadToFileW

rpcrt4

NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrStubForwardingFunction
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
NdrDllUnregisterProxy

wininet

InternetQueryOptionW
InternetSetOptionW
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW
InternetConnectW
HttpSendRequestW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindNextUrlCacheEntryExW
FindFirstUrlCacheEntryExW
InternetOpenW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 216KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 115B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7263584176e712755a5df9fa64b8207

Headers

File Characteristics

Imports

version

imagehlp

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

rpcrt4

wininet

Exports

Exports

Sections

.text Size: 216KB - Virtual size: 213KB

.orpc Size: 4KB - Virtual size: 115B

.rdata Size: 60KB - Virtual size: 57KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 28KB - Virtual size: 26KB

.text
Size: 216KB - Virtual size: 213KB

.orpc
Size: 4KB - Virtual size: 115B

.rdata
Size: 60KB - Virtual size: 57KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 28KB - Virtual size: 26KB