144a25d5b5ec3ddde37e3ab98b88a394

Sharing

Copy URL

Twitter E-mail

General

Target

144a25d5b5ec3ddde37e3ab98b88a394
Size

145KB
MD5

144a25d5b5ec3ddde37e3ab98b88a394
SHA1

f459a3fbda2cd439b54b43fb047623c5436d4644
SHA256

16432777107699feeee1bbc080aa4917d5f5d6fe5d2e29253123445f5199ec84
SHA512

a5f8426d97eb6e49c155499221740ed0a0038d446d79552bb6814692f07a2510f7619978ba61e0c8d15730d10fb3fabee0dad7aca300d3fdf0bc6dc07ce4a15d
SSDEEP

3072:FzZkFJElOuXRCLT3AGtVZIrV7Nlqc+6/rAHz6zqr+PhIOL8ogGUNm5x6gci7:FzZTOuhCPwGtV2dNX8LoXTgwHJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
144a25d5b5ec3ddde37e3ab98b88a394

Files

144a25d5b5ec3ddde37e3ab98b88a394
.dll windows:5 windows x86 arch:x86

0728bfbdc039994cfaa661930ea583bf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCurrentProcess
SetFileAttributesW
SetLastError
GetSystemInfo
RemoveDirectoryW
lstrcmpW
MoveFileW
MoveFileExW
MultiByteToWideChar
UnmapViewOfFile
GetShortPathNameW
GetModuleFileNameW
GetSystemDirectoryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryW
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcatW
lstrlenW
lstrcpyW
GetVersionExW
Sleep
WaitForSingleObject
GetExitCodeProcess
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
GetPrivateProfileStructW
GetPrivateProfileStringW
WritePrivateProfileStructW
WritePrivateProfileStringW
CreateFileW
DeleteFileW
GetCurrentThread
CloseHandle
GetFileAttributesW
OutputDebugStringW
CreateDirectoryW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
lstrcpynW

msvcrt

wcscpy
_adjust_fdiv
_initterm
memmove
wcsrchr
strtol
_except_handler3
swprintf
wcstoul
wcsncmp
_wcsnicmp
realloc
_snwprintf
wcschr
wcslen
iswctype
_wcsicmp
wcscmp
malloc
wcstol
free

ntdll

RtlNtStatusToDosError
RtlFreeUnicodeString
RtlNtPathNameToDosPathName
RtlInitUnicodeString
RtlpEnsureBufferSize

setupapi

SetupQueueDeleteW
pSetupSetQueueFlags
SetupSetDirectoryIdW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupPromptForDiskW
SetupGetStringFieldW
SetupGetIntField
SetupFindNextLine
SetupFindFirstLineW
SetupCloseInfFile
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupFindNextMatchLineW
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupPromptReboot
SetupDefaultQueueCallbackW
SetupQueryInfFileInformationW
SetupGetInfInformationW
SetupGetFileCompressionInfoW
SetupQueueCopyW
SetupQueueRenameW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupCommitFileQueueW
SetupScanFileQueueW
SetupInstallFilesFromInfSectionW
SetupInitDefaultQueueCallbackEx
SetupOpenFileQueue
SetupOpenAppendInfFileW
SetupGetLineCountW
pSetupGetQueueFlags

advapi32

RegDeleteValueW
OpenThreadToken
AccessCheck
FreeSid
RevertToSelf
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
ImpersonateSelf
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW

user32

wvsprintfW
CharNextW
GetUserObjectInformationW
GetProcessWindowStation
CharPrevW
ExitWindowsEx

ole32

CoTaskMemFree
StringFromGUID2
IIDFromString
StringFromIID

Exports

Exports

DoInstall
DoInstallA
DoInstallW
DoUninstall
DoUninstallA
DoUninstallW
DriverInstallComponents
InstallComponentA
InstallComponentW
InstallInfSectionA
InstallInfSectionW
IsInteractiveWindowStation
IsUserAdmin
ProxyRemoteInstall
ProxyRemoteInstallA
ProxyRemoteInstallW
UninstallComponent

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0728bfbdc039994cfaa661930ea583bf

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

setupapi

advapi32

user32

ole32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 460B

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 460B

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 2KB - Virtual size: 2KB