11c008028b7b4adc460aa81b816da019

Sharing

Copy URL

Twitter E-mail

General

Target

11c008028b7b4adc460aa81b816da019
Size

312KB
MD5

11c008028b7b4adc460aa81b816da019
SHA1

cd2ad22603a95f8f096f4f3c99f3fea40ce17dd2
SHA256

94e1dc9fc21ff6dd9b90bffc68a2de48481ddd5a42b8db2f3f180385b9f54bd3
SHA512

03d17f346be2a297b21e4ff724a2703c6030547af57a5a42b41ec8b7a40ebbb5977c4b003578bc2bf69367dc46358138fc0b4737d81dff1089e7432010d43234
SSDEEP

6144:F26EYT7VyVS6T9L4Cbu9CbfNH9sZS6/oVz+UO5r93drmZI/Bq:FYS0VTKCbu9CbVeZS6OSUOL3dCZI/Bq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11c008028b7b4adc460aa81b816da019

Files

11c008028b7b4adc460aa81b816da019
.dll windows:4 windows x86 arch:x86

0d5d759e2a9868e390831cbe763dd1a7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
lstrlenA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetDateFormatA
GetFileSizeEx
CreateThread
GetTempFileNameA
GetTempPathA
GetFileSize
GetPrivateProfileStringA
GetPrivateProfileIntA
GlobalAlloc
GetCurrentThreadId
Module32Next
Module32First
CreateRemoteThread
FormatMessageA
GetModuleFileNameA
SetEndOfFile
SetFilePointerEx
MoveFileExA
CopyFileA
GetShortPathNameA
ExitProcess
SetFilePointer
GetWindowsDirectoryA
FreeResource
SizeofResource
LocalFileTimeToFileTime
SystemTimeToFileTime
LoadResource
FindResourceA
VirtualProtect
GetSystemTime
SetErrorMode
VirtualFree
GlobalUnlock
GlobalLock
RtlUnwind
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
CreateToolhelp32Snapshot
TlsAlloc
TlsSetValue
TlsFree
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetCPInfo
GetACP
GetOEMCP
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
HeapReAlloc
LCMapStringA
LCMapStringW
OutputDebugStringA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
VirtualAlloc
VirtualAllocEx
GetModuleHandleA
WriteProcessMemory
CreateProcessA
ReadProcessMemory
GetCurrentProcessId
GetTickCount
GetSystemDirectoryA
lstrcpyA
CreateNamedPipeA
ConnectNamedPipe
TerminateProcess
DisconnectNamedPipe
LocalFree
WriteFile
ReadFile
LoadLibraryExA
FreeLibrary
LoadLibraryA
GetProcAddress
CreateDirectoryA
WinExec
GetFileAttributesA
MoveFileA
RemoveDirectoryA
DeleteFileA
GetDriveTypeA
FindNextFileA
SetFileTime
SetFileAttributesA
FindFirstFileA
FindClose
CreateFileA
InterlockedExchangeAdd
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventA
SetEvent
WaitForSingleObject
GetLocalTime
GetCurrentProcess
CloseHandle
GetLastError
SetLastError
GetCommandLineA
MultiByteToWideChar
GetFileTime
GlobalMemoryStatus
GetSystemInfo
GetVolumeInformationA
GetDiskFreeSpaceExA
GetVersionExA
CreatePipe
GetStartupInfoA
Sleep
PeekNamedPipe
LocalAlloc
GetProcessHeap
OpenProcess
HeapAlloc
HeapFree
ProcessIdToSessionId
Process32First
HeapSize
Process32Next
lstrlenW
WideCharToMultiByte
TlsGetValue

advapi32

SetEntriesInAclA
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegisterServiceCtrlHandlerA
GetServiceKeyNameA
GetServiceDisplayNameA
ControlService
DeleteService
QueryServiceStatus
EnumServicesStatusA
SetServiceStatus
RegFlushKey
QueryServiceConfigA
RegRestoreKeyA
RegSaveKeyA
RegCreateKeyExA
RegEnumKeyA
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
OpenEventLogA
ClearEventLogA
CloseEventLog
LogonUserA
CreateProcessAsUserA
FreeSid
GetKernelObjectSecurity
GetSecurityDescriptorDacl
MakeAbsoluteSD
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
SetKernelObjectSecurity
AllocateAndInitializeSid
BuildTrusteeWithSidA
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
LookupAccountSidA
RevertToSelf
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
AdjustTokenPrivileges

gdi32

CreateCompatibleBitmap
GdiFlush
BitBlt
GetDIBits
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
GetObjectA
CreateBitmap
SelectObject
SetPixel
GetBitmapBits
DeleteObject
CreateDCA
GetDeviceCaps
DeleteDC
CreateCompatibleDC

shell32

CommandLineToArgvW
SHFileOperationA

user32

LoadCursorA
GetClassNameA
PostMessageA
FindWindowA
SystemParametersInfoA
CloseDesktop
EnumDesktopWindows
OpenDesktopA
SetThreadDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenInputDesktop
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
LoadIconA
CloseClipboard
GetWindowTextA
EmptyClipboard
GetClipboardData
OpenClipboard
keybd_event
MapVirtualKeyA
mouse_event
GetWindowRect
GetDesktopWindow
SwitchDesktop
ReleaseDC
GetWindowDC
GetCursorPos
RegisterClassA
CreateWindowExA
SetWindowLongA
SetWindowPos
DefWindowProcA
PostQuitMessage
GetWindowTextLengthA
GetKeyState
GetAsyncKeyState
ExitWindowsEx
GetForegroundWindow
DestroyWindow
GetWindowThreadProcessId
AttachThreadInput
GetProcessWindowStation
GetFocus
wsprintfA
GetWindowLongA
IsDialogMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
SetClipboardData

psapi

GetModuleBaseNameA
GetModuleFileNameExA
EnumProcessModules
GetModuleInformation
EnumProcesses

ws2_32

__WSAFDIsSet
send
recv
select
accept
WSAStartup
ntohs
listen
connect
inet_ntoa
closesocket
ioctlsocket
htons
sendto
WSAIoctl
gethostbyname
getsockname
inet_addr
socket
bind
WSAGetLastError
recvfrom
WSAAsyncSelect
htonl
WSACleanup
gethostname
shutdown
WSASocketA
WSADuplicateSocketA
ntohl
setsockopt
getpeername

netapi32

NetUserSetInfo
NetApiBufferFree
NetUserEnum
NetLocalGroupAddMembers
NetUserAdd
NetUserDel

dnsapi

DnsQuery_A
DnsRecordListFree

shlwapi

SHDeleteKeyA
PathMatchSpecA
PathStripPathA

wtsapi32

WTSQuerySessionInformationA
WTSEnumerateSessionsA
WTSFreeMemory

rasapi32

RasGetEntryDialParamsA
RasEnumEntriesA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

FtpOpenFileA
InternetConnectA
InternetReadFile
InternetWriteFile
InternetOpenA
InternetQueryDataAvailable
InternetCloseHandle
InternetOpenUrlA

ole32

CoInitialize
CoCreateInstance

Exports

Exports

DllMain
Install
LpkPresent
ScriptApplyDigitSubstitution
ScriptApplyLogicalWidth
ScriptBreak
ScriptCPtoX
ScriptCacheGetHeight
ScriptFreeCache
ScriptGetCMap
ScriptGetFontProperties
ScriptGetGlyphABCWidth
ScriptGetLogicalWidths
ScriptGetProperties
ScriptIsComplex
ScriptItemize
ScriptJustify
ScriptLayout
ScriptPlace
ScriptRecordDigitSubstitution
ScriptShape
ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringFree
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringOut
ScriptStringValidate
ScriptStringXtoCP
ScriptString_pLogAttr
ScriptString_pSize
ScriptString_pcOutChars
ScriptTextOut
ScriptXtoCP
ServiceMain
ShellMain
ShellMainThread
UnInstall
UspAllocCache
UspAllocTemp
UspFreeMem
ZxFunction000002
zxFunction001

Sections

.text
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d5d759e2a9868e390831cbe763dd1a7

Headers

File Characteristics

Imports

kernel32

advapi32

gdi32

shell32

user32

psapi

ws2_32

netapi32

dnsapi

shlwapi

wtsapi32

rasapi32

userenv

wininet

ole32

Exports

Exports

Sections

.text Size: 200KB - Virtual size: 199KB

.rdata Size: 60KB - Virtual size: 56KB

.data Size: 20KB - Virtual size: 46KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 200KB - Virtual size: 199KB

.rdata
Size: 60KB - Virtual size: 56KB

.data
Size: 20KB - Virtual size: 46KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 16KB - Virtual size: 15KB