0d59681f972027ef11e0db2b41e05ba3

Sharing

Copy URL

Twitter E-mail

General

Target

0d59681f972027ef11e0db2b41e05ba3
Size

380KB
MD5

0d59681f972027ef11e0db2b41e05ba3
SHA1

0275eec9b86ddcee35e9a6a5ede36f4193f83b2c
SHA256

e4dbf09345a9da8d7ddcbf2c168ee825383a68711e58deec860c91bbbed89813
SHA512

b435a03d870cdff9e6b6ec7b27c462ef94db839b333b25a80df41f643aa7a4766b4d5913ab69352f1fe0654290a360283840d086bcc555c7970ddebe6c92a6e8
SSDEEP

6144:FE7ygqLVwGT6v1flXIIUDth6RjCCeYxAVzBkanVJQ0ezmyWz6smS1ynnrvRia5nk:67ygqLSGO1tYIUDtMZCdVYQxmS1ynnrt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d59681f972027ef11e0db2b41e05ba3

Files

0d59681f972027ef11e0db2b41e05ba3
.dll windows:4 windows x86 arch:x86

c9311fb76f9bce756e80080302e29cf7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupOpenInfFileW
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupDiSetSelectedDriverW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDeviceInfoW
SetupDiOpenDevRegKey
SetupDiInstallDriverFiles
SetupScanFileQueueW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInstallParamsW
SetupDiGetClassDevsW
SetupDiEnumDriverInfoW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiBuildDriverInfoList
SetupCloseInfFile
SetupCloseFileQueue
CM_Get_DevNode_Registry_PropertyW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
SetupDiGetDriverInstallParamsW

ole32

CoInitialize
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc

kernel32

lstrlenW
lstrlenA
lstrcpynW
lstrcmpiW
lstrcmpW
WriteFile
WideCharToMultiByte
WaitForMultipleObjects
UnmapViewOfFile
UnhandledExceptionFilter
SystemTimeToFileTime
Sleep
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReleaseMutex
ReadFile
QueryPerformanceCounter
MultiByteToWideChar
MoveFileW
MapViewOfFile
LocalFree
LoadLibraryExW
CloseHandle
CompareFileTime
CompareStringA
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
DisableThreadLibraryCalls
EnterCriticalSection
FindNextFileW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetExitCodeProcess
GetExitCodeThread
GetFileSize
GetFileTime
GetFileType
GetLocalTime
GetLocaleInfoW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetVersionExW
GetVolumeInformationW
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection

wininet

InternetCrackUrlW
InternetGetConnectedState
InternetQueryOptionA
InternetCanonicalizeUrlW

oleaut32

VarR8FromI1
SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocString

user32

GetKeyboardType
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
SendMessageW
ExitWindowsEx
DispatchMessageW
CharUpperW
CharUpperA
CharNextW
CharLowerA
BlockInput
GetActiveWindow
TranslateMessage

shlwapi

StrToIntExW
StrStrIW
StrRChrW
StrCmpW
StrCmpIW
UrlGetPartW
PathRemoveBackslashW
PathIsUNCW
PathIsRootW
PathIsRelativeW
PathFindExtensionW
PathCompactPathA
StrChrW
PathStripToRootW

crypt32

CryptHashPublicKeyInfo
CertGetCertificateContextProperty

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9311fb76f9bce756e80080302e29cf7

Headers

File Characteristics

Imports

setupapi

ole32

kernel32

wininet

oleaut32

user32

shlwapi

crypt32

Sections

.text Size: 284KB - Virtual size: 284KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 16KB - Virtual size: 116KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 284KB - Virtual size: 284KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 16KB - Virtual size: 116KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 16KB - Virtual size: 16KB