217c161e49b5d357947c45b6fdf69a9a

Sharing

Copy URL Twitter E-mail

General

Target

217c161e49b5d357947c45b6fdf69a9a
Size

241KB
MD5

217c161e49b5d357947c45b6fdf69a9a
SHA1

5312028e94b6036c67582486a4f52be1e9edbe8a
SHA256

9f5caa1d0e83acae010b0cd1b7062f13de7bfe09928b02a4764536f4f062b06c
SHA512

687cc286be0001e0c5f523f34083cbfeb0feee3709ce498d5184178699e2cbb375a6bca395a4055b6253e2de7bfd0be96b99b8ce5c1b05e1af38bcf931c8606b
SSDEEP

6144:3+A/kt6xRMwYxi8h0VByhu22gCMO3ITETMrDdzmvZ:u0IUuRxi8WDyxAluETMf4B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
217c161e49b5d357947c45b6fdf69a9a

Files

217c161e49b5d357947c45b6fdf69a9a
.dll windows:4 windows x86 arch:x86

ee481b265ae5a1e6aa8e8e37b821b939

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetStdHandle
CreateThread
TerminateProcess
HeapSize
GetACP
GetTimeZoneInformation
ExitThread
GetFileType
HeapReAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
RaiseException
HeapAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
ReadFile
SetFilePointer
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapFree
GetCommandLineA
GetStartupInfoA
RtlUnwind
FileTimeToSystemTime
GetTickCount
FileTimeToLocalFileTime
SetErrorMode
GetFileAttributesA
GetFileTime
GetFileSize
GetFullPathNameA
FindClose
GetVolumeInformationA
FindFirstFileA
SetEndOfFile
FlushFileBuffers
UnlockFile
LockFile
HeapDestroy
WriteFile
GlobalGetAtomNameA
GlobalAddAtomA
GetVersion
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
lstrcmpA
GetVersionExA
GetCurrentThreadId
lstrcpyA
lstrcatA
CreateProcessA
WaitForSingleObject
GetPrivateProfileSectionA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
IsBadReadPtr
GetCurrentProcess
DuplicateHandle
GetProfileStringA
GetThreadLocale
SizeofResource
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GlobalAlloc
GetCurrentThread
MulDiv
SetLastError
CreateEventA
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
CloseHandle
GlobalFree
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
lstrcmpiA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetProcAddress
GlobalLock
lstrcpynA
GlobalUnlock
IsBadCodePtr
HeapCreate
VirtualFree
VirtualAlloc
OutputDebugStringA

gdi32

DeleteObject
GetDeviceCaps
GetViewportExtEx
CreatePen
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetMapMode
DPtoLP
GetTextColor
GetBkColor
LPtoDP
CreateDIBitmap
CreateCompatibleDC
BitBlt
GetTextExtentPointA
IntersectClipRect
SetWindowExtEx
ScaleWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportOrgEx
SetMapMode
OffsetViewportOrgEx
GetStockObject
SetBkMode
RestoreDC
SaveDC
SelectObject
DeleteDC
CreateBitmap
GetObjectA
PatBlt
SetTextColor
GetClipBox
SetBkColor
GetWindowExtEx
CreateSolidBrush
Rectangle

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

shell32

DragQueryFileA
DragFinish

comctl32

ord17

oledlg

ord8

ole32

CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemAlloc

olepro32

ord253

oleaut32

SysFreeString
SysStringLen
SysAllocStringByteLen
VariantChangeType
SysAllocString
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen

Sections

.text
Size: 185KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 472KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mstp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mstp02
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee481b265ae5a1e6aa8e8e37b821b939

Headers

File Characteristics

Imports

kernel32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 185KB - Virtual size: 440KB

.bss Size: - Virtual size: 472KB

.pdata Size: 4KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.shared Size: 4KB - Virtual size: 4KB

.mstp Size: 4KB - Virtual size: 4KB

.mstp02 Size: 4KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 4KB - Virtual size: 224B

.text
Size: 185KB - Virtual size: 440KB

.bss
Size: - Virtual size: 472KB

.pdata
Size: 4KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.shared
Size: 4KB - Virtual size: 4KB

.mstp
Size: 4KB - Virtual size: 4KB

.mstp02
Size: 4KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 4KB - Virtual size: 224B