f7d6497ee50e2826468dcf61be01e2f4

Sharing

Copy URL Twitter E-mail

General

Target

f7d6497ee50e2826468dcf61be01e2f4
Size

860KB
MD5

f7d6497ee50e2826468dcf61be01e2f4
SHA1

33b11ab7d73edecc73c9627dbf1c70de17508874
SHA256

e63dfa5b202a33dabaad2e401dab609ed458206a692b119c2a279359f27786f2
SHA512

fbbc1e216b758fc55d59f7299f281f885daacaa5aca28bb626b84eeb8c103e47a43d0172e547a77e4b46c2adbf47d7e3ce2f22f63871b4ea3c7d85143de8d70e
SSDEEP

12288:ZC/hxjpk35FaZRPzJs/gRoWSnC9n4COfU59nP3H7:ZSp05F4Js4ixCixIVP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7d6497ee50e2826468dcf61be01e2f4

Files

f7d6497ee50e2826468dcf61be01e2f4
.dll regsvr32 windows:4 windows x86 arch:x86

8162c3cc890db2145bae99364fdf499f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA
UrlEscapeA
PathFileExistsA

kernel32

TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GlobalFlags
GetCPInfo
GetOEMCP
FileTimeToSystemTime
WritePrivateProfileStringA
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
RtlUnwind
HeapAlloc
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
ExitProcess
HeapSize
TerminateProcess
GlobalHandle
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GlobalReAlloc
TlsGetValue
LocalAlloc
GetCurrentProcessId
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetThreadLocale
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetModuleFileNameW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
FormatMessageA
LocalFree
MulDiv
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
SetLastError
lstrcmpW
GetProcessHeap
HeapFree
CompareStringA
CompareStringW
InterlockedExchange
GetVersion
GlobalAlloc
GlobalLock
FreeResource
GlobalUnlock
GlobalFree
CreateThread
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
LockResource
RaiseException
DeleteCriticalSection
IsDBCSLeadByte
lstrcmpiA
LoadLibraryExA
SizeofResource
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
GetTempPathA
GetTempFileNameA
FindResourceA
LoadResource
WaitForSingleObject
GetTickCount
GetVersionExA
DeleteFileA
CloseHandle
GetLastError
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleFileNameA
Sleep
UnhandledExceptionFilter

user32

GetSysColorBrush
UnregisterClassA
GetWindowThreadProcessId
GetMessageA
TranslateMessage
ValidateRect
PostQuitMessage
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
MoveWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
GetMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
GetClassInfoExA
PostMessageA
GetWindowRect
SetTimer
KillTimer
EnableWindow
GetSysColor
GetDlgCtrlID
CallWindowProcA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetDesktopWindow
GetActiveWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamA
GetDlgItem
IsWindowEnabled
GetParent
SetCursor
UpdateWindow
InvalidateRect
RedrawWindow
CharNextA
DispatchMessageA
PeekMessageA
GetAsyncKeyState
IsWindow
CharUpperBuffA
LoadCursorA
ShowWindow
DestroyWindow
GetClientRect
GetWindow
GetFocus
LoadBitmapA
DefWindowProcA
GetWindowLongA
SetWindowLongA
GetNextDlgTabItem
EndDialog
PtInRect
GetCursorPos
GetClassLongA
SetClassLongA
AdjustWindowRectEx
CharUpperA
SendMessageA
CopyRect
GetClassNameA
EnumChildWindows
EnumWindows
LoadMenuA
GetSubMenu
TrackPopupMenu
DestroyMenu
GetClassInfoA
RegisterClassA
CreateWindowExA
BeginPaint
EndPaint

gdi32

GetMapMode
DeleteDC
CreateSolidBrush
GetStockObject
GetObjectA
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
CreateFontIndirectA
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegQueryValueA

shell32

ShellExecuteExA
ShellExecuteA

ole32

CreateStreamOnHGlobal
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString
SysStringLen
UnRegisterTypeLi
LoadTypeLi
SysAllocStringByteLen
VarBstrCmp
VariantInit
VariantCopy
VariantClear
VariantChangeType
OleLoadPicture

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 312KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 440KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8162c3cc890db2145bae99364fdf499f

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 312KB - Virtual size: 310KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 440KB - Virtual size: 439KB

.reloc Size: 40KB - Virtual size: 36KB

.text
Size: 312KB - Virtual size: 310KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 440KB - Virtual size: 439KB

.reloc
Size: 40KB - Virtual size: 36KB