2a27f5177d1cf787b6f3eae597a272b1

Sharing

Copy URL Twitter E-mail

General

Target

2a27f5177d1cf787b6f3eae597a272b1
Size

168KB
MD5

2a27f5177d1cf787b6f3eae597a272b1
SHA1

d740ee37a4cd6ad5958528ff02c2bdec6b648d29
SHA256

71e44e900699e94e180be4dbff24e3e0e2d29eba64090849d0a42e2b12733b95
SHA512

4b4a85ec178035ce2a925ec6d73b487b4bd4cf74dfb3d8dc9a4fe06193336ae9328d2dcb5a8d2f90f91c7f73228e820bc810d853f6efec39308d3f2e431d5f6c
SSDEEP

3072:1P2ANBCWO3zarwZt4sySDL2lbKuEy9o/RZWeAJpO4qMJHzPjpgGwfmS:lFO3K9SDylmuE8MZWFpO4qmzPOGwfj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a27f5177d1cf787b6f3eae597a272b1

Files

2a27f5177d1cf787b6f3eae597a272b1
.dll regsvr32 windows:4 windows x86 arch:x86

33a47a515ee905d806cfa4f0067595e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CreateWindowExA
ShowWindow
GetMessageA
TranslateMessage
OpenClipboard
RegisterClassExA
SetWindowPos
SystemParametersInfoA
EnumWindows
EnumChildWindows
GetWindowThreadProcessId
GetClassNameA
CloseClipboard
wsprintfA
KillTimer
SetTimer
DefWindowProcA
DispatchMessageA

rpcrt4

UuidToStringA

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

wininet

InternetCloseHandle
InternetOpenA
HttpQueryInfoA
InternetSetOptionA
InternetOpenUrlA
InternetReadFile

shlwapi

SHSetValueA
StrStrIA
SHGetValueA

msvcrt

??1exception@@UAE@XZ
wcscmp
tolower
isspace
isupper
islower
ispunct
strerror
isxdigit
wctomb
__mb_cur_max
printf
strstr
srand
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
isalnum
wcslen
isalpha
isgraph
strncpy
strchr
strtol
atoi
tmpnam
fopen
fwrite
fclose
malloc
free
??2@YAPAXI@Z
strtok
??3@YAXPAX@Z
__CxxFrameHandler
toupper
??0exception@@QAE@ABV0@@Z

winmm

timeGetTime

advapi32

RegCloseKey
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExA

ole32

CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
SysFreeString
GetErrorInfo

netapi32

Netbios

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
lstrcpynA
FormatMessageA
LocalFree
GetFullPathNameA
SetLastError
GetVersionExA
lstrlenA
GetModuleHandleA
lstrcpyA
GetWindowsDirectoryA
MultiByteToWideChar
GetCurrentDirectoryA
lstrcmpA
lstrcmpiA
HeapAlloc
HeapSize
GetCurrentProcessId
GetLastError
HeapFree
GetProcessHeap
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
SleepEx
CreateProcessA
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetProcAddress
LoadLibraryA
DeleteFileA
GetSystemDirectoryA
GetLocalTime
GetThreadTimes
CreateFileA
GetProcessTimes
GetCurrentProcess
FreeLibrary
Sleep
GetVersion
MoveFileExA
GetCurrentThread
OpenProcess
CloseHandle

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33a47a515ee905d806cfa4f0067595e3

Headers

File Characteristics

Imports

user32

rpcrt4

psapi

wininet

shlwapi

msvcrt

winmm

advapi32

ole32

oleaut32

netapi32

version

kernel32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 24KB - Virtual size: 24KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 24KB - Virtual size: 24KB

.reloc
Size: 12KB - Virtual size: 8KB