185165d21c1d09270d88f4cb99fd1558

Sharing

Copy URL Twitter E-mail

General

Target

185165d21c1d09270d88f4cb99fd1558
Size

494KB
MD5

185165d21c1d09270d88f4cb99fd1558
SHA1

df6f53e3358262791ff92eb6fffc4f888348389b
SHA256

4ac81fc8500c3d1aeb77aaeddbf41794de77e1ca5a5d3ee511db1de236b4a35f
SHA512

0b96b9b9e9eda40a55c86931b21a7e38e633826535f7293694d077a43bda4314475f7b5ae2cccbd631b7533aaffe45f16f57d2300cdd165d4ab9dd82237b68e7
SSDEEP

6144:po2llklaD/rqXTqA8/pPBVUXu8X5Ega5KGqJqEDKgLUnk9777zXoQQvJT3cxqWAH:yeoa5Z0upga5+DtUm77DpqWd9xhw/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
185165d21c1d09270d88f4cb99fd1558

Files

185165d21c1d09270d88f4cb99fd1558
.dll windows:6 windows x64 arch:x64

d7d8deaf24507380848462b379e7092e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThread
GetSystemTime
GetLocalTime
GetTickCount
CreateFileMappingW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetThreadSelectorEntry
GlobalDeleteAtom
GetCommConfig
SetCommConfig
CreateSemaphoreA
CreateWaitableTimerA
OpenWaitableTimerA
CreateFileMappingA
GlobalAddAtomW
GetPrivateProfileSectionNamesW
GetSystemWow64DirectoryW
CreateNamedPipeA
IsBadCodePtr
IsBadStringPtrA
SetComputerNameExA
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
SwitchToThread
TerminateJobObject
CreateActCtxW
ReleaseActCtx
ZombifyActCtx
ActivateActCtx
DeactivateActCtx
GetCurrencyFormatA
EnumLanguageGroupLocalesA
EnumUILanguagesW
GetConsoleScreenBufferInfo
FlushConsoleInputBuffer
SetConsoleCursorPosition
GetConsoleTitleW
WriteConsoleW
GetConsoleAliasW
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateThread
GetCurrentProcessId
SignalObjectAndWait
Sleep
SetWaitableTimer
CreateEventA
CreateMutexA
WaitForSingleObject
ReleaseMutex
SetEvent
GetOverlappedResult
PeekNamedPipe
DisconnectNamedPipe
ConnectNamedPipe
CreatePipe
GetLastError
CloseHandle
ReadFile
GetShortPathNameW
GetFileSize
GetFileAttributesA
FindFirstFileW
FindFirstFileA
FindClose
CreateFileW
CreateJobObjectA
GetStdHandle

shlwapi

ord280
SHRegDeleteUSValueA
SHRegCreateUSKeyA
SHEnumValueA
SHSetValueW
SHGetValueW
SHGetValueA
UrlApplySchemeW
UrlCreateFromPathW
UrlGetLocationW
UrlCombineA
PathSkipRootW
ord225
PathFileExistsW
PathCombineW
PathCanonicalizeW
ord151
ord487
wvnsprintfW
PathIsUNCServerShareA
StrSpnW
StrRStrIA
StrFormatKBSizeA
StrCSpnIA
StrCmpNIW
SHCreateStreamOnFileEx
ColorHLSToRGB
PathRemoveArgsW
PathIsSameRootA

imm32

ImmGetCompositionFontW
ImmGetOpenStatus
ImmGetGuideLineA
ImmGetCandidateListCountW
ImmGetCandidateListCountA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmGetIMEFileNameA
ImmGetDescriptionA
ImmSetCompositionFontW
ImmGetConversionListW
ImmGetStatusWindowPos
ImmSetStatusWindowPos
ImmGetCompositionWindow
ImmSetCompositionWindow
ImmGetCandidateWindow
ImmSetCandidateWindow
ImmRegisterWordA
ImmRegisterWordW
ImmUnregisterWordA
ImmUnregisterWordW
ImmGetRegisterWordStyleA
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmGetImeMenuItemsA
ImmGetCompositionFontA

winmm

timeGetSystemTime
joyGetNumDevs
joyGetDevCapsA
joyGetThreshold
joyReleaseCapture
mixerGetControlDetailsW
joySetThreshold
mmioAscend
mmioDescend
mmioSendMessage
mmioWrite
mixerGetControlDetailsA
waveOutGetErrorTextW
mixerGetID
mixerGetDevCapsW
waveOutGetNumDevs
mixerGetNumDevs
auxGetVolume
auxSetVolume
auxGetNumDevs
midiInGetID
midiInGetDevCapsA
midiOutGetID
midiOutGetErrorTextA
midiOutGetNumDevs
waveOutGetID
joySetCapture
mmioRead
mmioClose
mciGetCreatorTask
mmioOpenW
mmioOpenA
mciGetYieldProc
mciSetYieldProc
mciGetErrorStringA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDW
mciGetDeviceIDA
mciSendCommandA
mixerGetDevCapsA

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__std_exception_copy
__std_exception_destroy
__std_type_info_destroy_list
__C_specific_handler
memset
memmove
memcpy
memcmp
memchr
_CxxThrowException
strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_cexit
exit
_initterm_e
_initterm
_initialize_narrow_environment
_errno
_seh_filter_dll
_configure_narrow_argv
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
strerror

api-ms-win-crt-string-l1-1-0

isxdigit
wcsncat
wcsncpy
strncpy
strncat
isspace
_wcsnicmp

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
_callnewh

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-convert-l1-1-0

_ltow
_ultow
_itoa
_itow
strtoul
_ltoa
atoi
strtod
_strtoi64
_ultoa

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fclose
putc
fwrite
fseek
putchar
__stdio_common_vsprintf
fread
fputs
fflush
fputc
fgetc
fopen
__acrt_iob_func

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

sqrtf
log
powf

Exports

Exports

_crypto_pwhash_argon2i_pick_best_implementation
argon2_pick_best_implementation
chacha_keysetup
crypto_core_curve25519_ref10_ge_p2_dbl
crypto_generichash_blake2b__blake2b
crypto_stream_chacha20_ietf
randombytes_sysrandom_stir
salsa20_encrypt_bytes
smbFreeBuf

Sections

.text
Size: 374KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7d8deaf24507380848462b379e7092e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

imm32

winmm

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 374KB - Virtual size: 373KB

.rdata Size: 97KB - Virtual size: 96KB

.data Size: 12KB - Virtual size: 51KB

.pdata Size: 7KB - Virtual size: 6KB

.orpc Size: 512B - Virtual size: 512B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 168B

.text
Size: 374KB - Virtual size: 373KB

.rdata
Size: 97KB - Virtual size: 96KB

.data
Size: 12KB - Virtual size: 51KB

.pdata
Size: 7KB - Virtual size: 6KB

.orpc
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 168B