044a52b7c4b41c9724c7abef08920300

Sharing

Copy URL

Twitter E-mail

General

Target

044a52b7c4b41c9724c7abef08920300
Size

1.7MB
MD5

044a52b7c4b41c9724c7abef08920300
SHA1

b23c372109b9d0b392d7b9fd5cdb1c25735f4047
SHA256

9dfe843a61c3bd78c30380d5c132273913dcd3872a2a8649ffe93b4d43ed3445
SHA512

7f70ce66d7bbb8955e787abc966be3dcc98c0496d9ef5c0212e89a9cc8029cbbf7d11e16c294b2f2323b2d612a16f276cdaffc13c14c379c7f8507a9ed069b03
SSDEEP

12288:uVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:zfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
044a52b7c4b41c9724c7abef08920300

Files

044a52b7c4b41c9724c7abef08920300
.dll windows:5 windows x64 arch:x64

6668be91e2c948b183827f040944057f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

LookupIconIdFromDirectoryEx
WaitForInputIdle
GetParent
GetFocus

setupapi

CM_Get_Resource_Conflict_DetailsW

kernel32

DeleteCriticalSection
DeleteTimerQueue
TerminateJobObject
GetFileInformationByHandle
GetThreadLocale
GetNamedPipeServerProcessId
GetConsoleFontSize

gdi32

CreateBitmapIndirect
GetPolyFillMode

crypt32

CertGetCTLContextProperty

advapi32

AddAccessDeniedObjectAce

shlwapi

ChrCmpIW

Exports

Exports

CloseThreadWaitChainSession
GetThreadWaitChain
OpenThreadWaitChainSession
RegisterWaitChainCOMCallback
WerAddExcludedApplication
WerFreeString
WerRemoveExcludedApplication
WerReportAddDump
WerReportAddFile
WerReportCloseHandle
WerReportCreate
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerStoreClose
WerStoreGetFirstReportKey
WerStoreGetNextReportKey
WerStoreGetReportCount
WerStoreGetSizeOnDisk
WerStoreOpen
WerStorePurge
WerStoreQueryReportMetadataV1
WerStoreQueryReportMetadataV2
WerStoreQueryReportMetadataV3
WerStoreUploadReport
WerSysprepCleanup
WerSysprepGeneralize
WerUnattendedSetup
WerpAddAppCompatData
WerpAddFile
WerpAddFileBuffer
WerpAddFileCallback
WerpAddIfRegisteredForAppLocalDump
WerpAddMemoryBlock
WerpAddRegisteredDataToReport
WerpAddRegisteredDumpsToReport
WerpAddRegisteredMetadataToReport
WerpAddTerminationReason
WerpArchiveReport
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFree
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdInitialize
WerpAuxmdMapFile
WerpCancelUpload
WerpCleanWer
WerpCloseStore
WerpCreateIntegratorReportId
WerpCreateMachineStore
WerpDeleteReport
WerpDestroyWerString
WerpEnumerateStoreNext
WerpEnumerateStoreStart
WerpExtractReportFiles
WerpFlushImageCache
WerpForceDeferredCollection
WerpFreeString
WerpFreeUnmappedVaRanges
WerpGetAADTenantInfo
WerpGetBucketId
WerpGetDynamicParameter
WerpGetEventType
WerpGetExtendedDiagData
WerpGetFileByIndex
WerpGetFilePathByIndex
WerpGetIntegratorReportId
WerpGetLegacyBucketId
WerpGetLoadedModuleByIndex
WerpGetNumFiles
WerpGetNumLoadedModules
WerpGetNumSigParams
WerpGetPathOfWERTempDirectory
WerpGetReportConsent
WerpGetReportCount
WerpGetReportFinalConsent
WerpGetReportFlags
WerpGetReportId
WerpGetReportInformation
WerpGetReportSettings
WerpGetReportTime
WerpGetReportType
WerpGetResponseId
WerpGetSigParamByIndex
WerpGetStoreLocation
WerpGetStorePath
WerpGetStoreType
WerpGetTextFromReport
WerpGetUIParamByIndex
WerpGetUploadTime
WerpGetWerStringData
WerpGetWow64Process
WerpHashApplicationParameters
WerpInitializeImageCache
WerpIsDisabled
WerpIsOnBattery
WerpIsTransportAvailable
WerpLoadReport
WerpLoadReportFromBuffer
WerpOpenMachineArchive
WerpOpenMachineQueue
WerpPromptUser
WerpPruneStore
WerpReportCancel
WerpReportSprintfParameter
WerpReserveMachineQueueReportDir
WerpResetTransientImageCacheStatistics
WerpRestartApplication
WerpSetAADTenantInfo
WerpSetAuxiliaryArchivePath
WerpSetCallBack
WerpSetDefaultUserConsent
WerpSetDynamicParameter
WerpSetEventName
WerpSetExitListeners
WerpSetIntegratorReportId
WerpSetIptEnabled
WerpSetProcessTimelines
WerpSetQuickDumpType
WerpSetReportApplicationIdentity
WerpSetReportFlags
WerpSetReportInformation
WerpSetReportIsFatal
WerpSetReportNamespaceParameter
WerpSetReportOption
WerpSetReportTime
WerpSetReportUploadContextToken
WerpSetTelemetryAppParams
WerpSetTelemetryKernelParams
WerpSetTelemetryServiceParams
WerpSetTtdStatus
WerpShowUpsellUI
WerpStitchedMinidumpVmPostReadCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmQueryCallback
WerpSubmitReportFromStore
WerpTraceAuxMemDumpStatistics
WerpTraceDuration
WerpTraceImageCacheStatistics
WerpTraceSnapshotStatistics
WerpTraceStitchedDumpWriterStatistics
WerpTraceUnmappedVaRangesStatistics
WerpUnmapProcessViews
WerpValidateReportKey
WerpWalkGatherBlocks

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.qkm
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cvjb
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tlmkv
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wucsxe
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fltwtj
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sfplio
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rpg
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bewzc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vksvaw
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wmhg
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kswemc
Size: 4KB - Virtual size: 877B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kaxfk
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pjf
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.favk
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vhtukj
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hmbyox
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.djv
Size: 4KB - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hpern
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.czzwqg
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jxjvn
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jfsnsk
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nzvifv
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xbp
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qjobrk
Size: 4KB - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.percvn
Size: 4KB - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lfh
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6668be91e2c948b183827f040944057f

Headers

DLL Characteristics

File Characteristics

Imports

user32

setupapi

kernel32

gdi32

crypt32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 260KB - Virtual size: 257KB

.rdata Size: 404KB - Virtual size: 403KB

.data Size: 96KB - Virtual size: 94KB

.pdata Size: 4KB - Virtual size: 300B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 8KB

.qkm Size: 4KB - Virtual size: 1KB

.cvjb Size: 8KB - Virtual size: 7KB

.tlmkv Size: 4KB - Virtual size: 2KB

.wucsxe Size: 280KB - Virtual size: 276KB

.fltwtj Size: 8KB - Virtual size: 4KB

.sfplio Size: 4KB - Virtual size: 1KB

.rpg Size: 280KB - Virtual size: 276KB

.bewzc Size: 8KB - Virtual size: 4KB

.vksvaw Size: 4KB - Virtual size: 1KB

.wmhg Size: 8KB - Virtual size: 4KB

.kswemc Size: 4KB - Virtual size: 877B

.kaxfk Size: 8KB - Virtual size: 6KB

.pjf Size: 4KB - Virtual size: 2KB

.favk Size: 4KB - Virtual size: 503B

.vhtukj Size: 280KB - Virtual size: 276KB

.hmbyox Size: 4KB - Virtual size: 2KB

.djv Size: 4KB - Virtual size: 318B

.hpern Size: 4KB - Virtual size: 1KB

.czzwqg Size: 4KB - Virtual size: 2KB

.jxjvn Size: 4KB - Virtual size: 2KB

.jfsnsk Size: 4KB - Virtual size: 503B

.nzvifv Size: 4KB - Virtual size: 2KB

.xbp Size: 28KB - Virtual size: 27KB

.qjobrk Size: 4KB - Virtual size: 318B

.percvn Size: 4KB - Virtual size: 318B

.lfh Size: 8KB - Virtual size: 4KB

.text
Size: 260KB - Virtual size: 257KB

.rdata
Size: 404KB - Virtual size: 403KB

.data
Size: 96KB - Virtual size: 94KB

.pdata
Size: 4KB - Virtual size: 300B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 8KB

.qkm
Size: 4KB - Virtual size: 1KB

.cvjb
Size: 8KB - Virtual size: 7KB

.tlmkv
Size: 4KB - Virtual size: 2KB

.wucsxe
Size: 280KB - Virtual size: 276KB

.fltwtj
Size: 8KB - Virtual size: 4KB

.sfplio
Size: 4KB - Virtual size: 1KB

.rpg
Size: 280KB - Virtual size: 276KB

.bewzc
Size: 8KB - Virtual size: 4KB

.vksvaw
Size: 4KB - Virtual size: 1KB

.wmhg
Size: 8KB - Virtual size: 4KB

.kswemc
Size: 4KB - Virtual size: 877B

.kaxfk
Size: 8KB - Virtual size: 6KB

.pjf
Size: 4KB - Virtual size: 2KB

.favk
Size: 4KB - Virtual size: 503B

.vhtukj
Size: 280KB - Virtual size: 276KB

.hmbyox
Size: 4KB - Virtual size: 2KB

.djv
Size: 4KB - Virtual size: 318B

.hpern
Size: 4KB - Virtual size: 1KB

.czzwqg
Size: 4KB - Virtual size: 2KB

.jxjvn
Size: 4KB - Virtual size: 2KB

.jfsnsk
Size: 4KB - Virtual size: 503B

.nzvifv
Size: 4KB - Virtual size: 2KB

.xbp
Size: 28KB - Virtual size: 27KB

.qjobrk
Size: 4KB - Virtual size: 318B

.percvn
Size: 4KB - Virtual size: 318B

.lfh
Size: 8KB - Virtual size: 4KB