1d5ee02e51f9f8fe22838937303ab8a0

Sharing

Copy URL Twitter E-mail

General

Target

1d5ee02e51f9f8fe22838937303ab8a0
Size

423KB
MD5

1d5ee02e51f9f8fe22838937303ab8a0
SHA1

4e8a1f88a5a469c8344be588afdebc608c8fed2c
SHA256

3018b032892011affc0d45986c3ec9840443e263941de4f1172b323621067cff
SHA512

4ca18dd19d839f117bb7886939a26b0ce2232a774a458dfe46d4c40cd539260f42c1cd3579833f1c38298cda3395955b753d420cb00fc3a9d2fba57e4955efa4
SSDEEP

12288:xFnFo3/GwqF4lUCgyCU5XO+k+Qp91Qb3RjB+n8h:xFnKPGzSsGICQp91Qb35Byc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d5ee02e51f9f8fe22838937303ab8a0

Files

1d5ee02e51f9f8fe22838937303ab8a0
.dll windows:4 windows x86 arch:x86

fd839a896687b83a4341d4eacf60b077

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

LdrGetDllHandle
NtAllocateVirtualMemory
RtlUshortByteSwap

advapi32

EqualSid
LookupAccountNameW
RegQueryValueExW
ReportEventW
CloseServiceHandle
RegQueryInfoKeyW
ChangeServiceConfigW
GetSecurityDescriptorControl
RegSetKeySecurity
OpenThreadToken
RegEnumValueA
SetSecurityDescriptorDacl
RegSetValueExW
SetSecurityDescriptorGroup
CopySid
MakeAbsoluteSD
GetUserNameW
RegisterEventSourceW
StartServiceW
GetServiceDisplayNameW
LookupPrivilegeValueW
RegEnumKeyExA
QueryServiceStatus
SetFileSecurityW
GetLengthSid
QueryServiceConfigW
InitializeAcl
AddAccessDeniedAce
DeregisterEventSource
IsValidSecurityDescriptor
InitializeSecurityDescriptor
DuplicateToken
PrivilegeCheck
GetSecurityDescriptorLength
RegDeleteKeyW
RegConnectRegistryW
GetFileSecurityW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
EnumDependentServicesW
AllocateAndInitializeSid
RegQueryValueExA
ConvertSidToStringSidW
AdjustTokenPrivileges
GetAce
GetSidLengthRequired
RegEnumKeyW
ControlService
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
OpenServiceW
SetThreadToken
OpenSCManagerW
RegGetKeySecurity
SetTokenInformation
RegCloseKey
AddAccessAllowedAce
MakeSelfRelativeSD
RegEnumValueW
RegSetValueExA
RegFlushKey
DeleteService
GetTokenInformation
RegEnumKeyExW
OpenProcessToken
FreeSid
GetSecurityDescriptorGroup
GetSidSubAuthorityCount
CreateServiceW

user32

GetWindowTextLengthW
GetClientRect
LoadIconW
IsWindowEnabled
DrawTextW
PostMessageW
SendMessageW
SystemParametersInfoW
GetDlgItem
SetUserObjectSecurity
ExitWindowsEx
SetDlgItemTextW
SetWindowPos
TranslateMessage
MoveWindow
GetWindow
IsCharLowerW
IsDialogMessageW
DialogBoxParamW
GetSystemMenu
SetFocus
MapWindowPoints
CreateDialogParamW
CharPrevA
CreateWindowExW
UnregisterClassW
SetWindowLongW
GetUserObjectInformationW
GetDC
SetForegroundWindow
GetWindowRect
CharUpperBuffW
DestroyWindow
GetWindowThreadProcessId
SetWindowTextW
GetFocus
MessageBoxW
GetWindowLongW
DefWindowProcW
CopyRect
SetCursor
GetWindowTextW
IsWindowVisible
RegisterWindowMessageW
MsgWaitForMultipleObjects
RegisterClassW
GetProcessWindowStation
LoadCursorW
SendMessageTimeoutW
EndDialog
DispatchMessageW
PeekMessageW
GetSystemMetrics
SendDlgItemMessageW
PostQuitMessage
CharPrevW
CharUpperW
EnumWindows
CharNextA
LoadStringW
GetDlgItemTextW
CharNextW
RemoveMenu
ShowWindow
GetActiveWindow
CharLowerW
InvalidateRect
ReleaseDC
EnableWindow
PostThreadMessageW

kernel32

GetUserDefaultLangID
CreateFileW
lstrlenA
CreateFileMappingW
GetSystemInfo
IsDebuggerPresent
MoveFileW
DosDateTimeToFileTime
SystemTimeToFileTime
GetUserDefaultLCID
GlobalAlloc
OpenProcess
EnumResourceLanguagesW
FindResourceExW
GlobalReAlloc
InterlockedExchange
LocalFree
GetFileType
EnumResourceNamesW
GetShortPathNameW
Sleep
SetUnhandledExceptionFilter
LoadResource
TlsSetValue
TerminateProcess
LockResource
SetLastError
ExitProcess
CreateThread
WaitForSingleObject
UnlockFile
GetModuleHandleW
GetModuleFileNameA
GetSystemDefaultLangID
GetCurrentThreadId
SizeofResource
GetTempPathW
SetEvent
RemoveDirectoryW
GetSystemDirectoryW
ReleaseMutex
GetTempFileNameW
OutputDebugStringW
SetEnvironmentVariableW
TlsAlloc
WriteFile
LoadLibraryExW
FreeLibrary
GetExitCodeThread
GetCurrentThread
VirtualFree
GetSystemTimeAsFileTime
GlobalFree
InterlockedDecrement
GetDiskFreeSpaceExW
DisableThreadLibraryCalls
RaiseException
GlobalUnlock
WriteProfileStringW
ResetEvent
CreateMutexW
GetCurrentProcess
FileTimeToDosDateTime
ExitThread
GetEnvironmentVariableW
FindFirstFileW
GetDriveTypeW
GetVolumeInformationW
SetFileAttributesW
GetCurrentDirectoryW
LeaveCriticalSection
FileTimeToSystemTime
GetProcAddress
FormatMessageW
WritePrivateProfileStringW
ExpandEnvironmentStringsW
GetDateFormatW
MultiByteToWideChar
lstrcpynW
QueryPerformanceCounter
GetFileSizeEx
VirtualAlloc
lstrlenW
GetPrivateProfileStringW
GetOverlappedResult
FormatMessageA
ResumeThread
SetFileTime
GetDiskFreeSpaceW
lstrcmpiA
GetTickCount
GlobalLock
GetTimeFormatW
SetErrorMode
CreateEventW
lstrcmpW
GetEnvironmentStringsW
DeleteFileW
MapViewOfFile
WaitForMultipleObjects
TlsGetValue
lstrcmpiW
GetLocalTime
OpenMutexW
UnhandledExceptionFilter
GetExitCodeProcess
GetACP
GetCurrentProcessId
GetLastError
WideCharToMultiByte
GetNumberFormatW
InitializeCriticalSection
TlsFree
LockFile
OutputDebugStringA
FreeLibraryAndExitThread
SetEndOfFile
FreeEnvironmentStringsW
DebugBreak
GlobalMemoryStatus
SetFilePointer
DeleteCriticalSection
LoadLibraryW
GetVersionExW
lstrcpynA
lstrcmpA
MulDiv
UnmapViewOfFile
CompareStringW
FindNextFileW
GetFileTime
EnterCriticalSection
CreateProcessW
CloseHandle
FlushFileBuffers
LocalAlloc
GetLocaleInfoW
CreateDirectoryW
DuplicateHandle
GetProfileStringW
ReadFile
InterlockedIncrement
GetFileSize
GetFileAttributesW
ExpandEnvironmentStringsA
FindClose
GetModuleFileNameW
GetComputerNameW
GetWindowsDirectoryW
TerminateThread
FileTimeToLocalFileTime
MoveFileExW
IsValidCodePage
LocalFileTimeToFileTime

gdi32

EnumFontFamiliesExW
CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W
SelectObject
GetTextMetricsW
GetDeviceCaps
GetTextFaceW
CreateFontW
RemoveFontResourceW
AddFontResourceW

rpcrt4

CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrDllRegisterProxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_CountRefs
NdrDllGetClassObject
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_Disconnect
NdrDllUnregisterProxy
CStdStubBuffer_QueryInterface
NdrClientCall2
NdrOleAllocate
NdrOleFree
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_Connect

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 81KB - Virtual size: 944KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd839a896687b83a4341d4eacf60b077

Headers

File Characteristics

Imports

ntdll

advapi32

user32

kernel32

gdi32

rpcrt4

Sections

.text Size: 22KB - Virtual size: 21KB

.reloc Size: 512B - Virtual size: 24B

.rsrc Size: 252KB - Virtual size: 252KB

.rdata Size: 65KB - Virtual size: 65KB

.data Size: 81KB - Virtual size: 944KB

.text
Size: 22KB - Virtual size: 21KB

.reloc
Size: 512B - Virtual size: 24B

.rsrc
Size: 252KB - Virtual size: 252KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 81KB - Virtual size: 944KB