298ce04412c70344e3ab25aef4451ffd

Sharing

Copy URL Twitter E-mail

General

Target

298ce04412c70344e3ab25aef4451ffd
Size

888KB
MD5

298ce04412c70344e3ab25aef4451ffd
SHA1

8e442da92253084048db24abaa2f7a2f67ba7a6a
SHA256

fb562b4ed15653596686e6f38da45ea28cfce1b6a2cb012bcd69dbd640ab4c9b
SHA512

688bc752bd282be1071db4a3150fa585a105223cd789386d4baf7cc94dee34c99817dbd9af2490470313c591696c9a0ba25db0df2ad7b1d5f38a870b1a01464f
SSDEEP

12288:A2zzjG2M+oTtE6ZFvSt2C1UflD+ADfcacH8RXCKL6qBD/GaVNPeLMx597QO932KC:bjquovSt24oDLRX/BbGOMS9L32bb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
298ce04412c70344e3ab25aef4451ffd

Files

298ce04412c70344e3ab25aef4451ffd
.dll regsvr32 windows:4 windows x86 arch:x86

6fe1aea8ce9b74ea4e2e3fe85637d80d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA

shlwapi

PathFileExistsA
PathRemoveFileSpecA
PathFindExtensionA

winmm

PlaySoundA

setupapi

SetupIterateCabinetA

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymInitialize
SymLoadModule

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

SetFilePointer
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
InterlockedDecrement
InterlockedIncrement
lstrlenA
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
CloseHandle
HeapFree
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
GetTempPathA
SetCurrentDirectoryA
LoadLibraryA
DebugBreak
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
lstrcpynA
FormatMessageA
IsBadReadPtr
ReadProcessMemory
GetModuleFileNameA
CreateFileA
FreeEnvironmentStringsA
GlobalUnlock
GlobalLock
WinExec
VerLanguageNameA
RemoveDirectoryA
MoveFileExA
DeleteFileA
WriteFile
CopyFileA
MoveFileA
GetTempFileNameA
lstrcpyA
lstrcatA
lstrlenW
FindFirstFileA
FindNextFileA
FindClose
GlobalFree
GlobalAlloc
lstrcmpA
MulDiv
FreeLibrary
Sleep
GetTickCount
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
TerminateProcess
ReadFile
GetFullPathNameA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateThread
ResumeThread
ExitThread
HeapReAlloc
RtlUnwind
LocalFree
LocalAlloc
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
FlushFileBuffers
GetSystemTimeAsFileTime
GetCommandLineA
SetEndOfFile
ExitProcess
GetOEMCP
GetCPInfo
TlsAlloc
CompareStringA
CompareStringW
OpenProcess
GetStartupInfoA
GetFileType
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapSize
GetStringTypeA
GetStringTypeW
GetStdHandle
UnhandledExceptionFilter
GetDriveTypeA
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetHandleCount
TlsFree

user32

InsertMenuA
GetSubMenu
LoadMenuA
CharUpperA
EnableMenuItem
GetMenuItemInfoA
OffsetRect
ClientToScreen
MapWindowPoints
GetAsyncKeyState
SetWindowRgn
InflateRect
IsWindowEnabled
SystemParametersInfoA
GetCapture
GetDlgCtrlID
DrawFocusRect
DrawEdge
UpdateWindow
LoadImageA
IsWindowVisible
SetWindowsHookExA
TrackPopupMenu
UnhookWindowsHookEx
EndMenu
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDC
ReleaseDC
GetDesktopWindow
RedrawWindow
BeginPaint
FillRect
EndPaint
IsChild
GetSysColor
DestroyAcceleratorTable
CharLowerA
RegisterWindowMessageA
RegisterHotKey
UnregisterHotKey
PeekMessageA
GetMessagePos
LoadBitmapA
DrawFrameControl
GetCursorPos
PostMessageA
GetWindow
GetSystemMetrics
DialogBoxIndirectParamA
WindowFromPoint
CallNextHookEx
SetCursor
ScreenToClient
PtInRect
GetClassNameA
DestroyCursor
SetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
EndDialog
SetFocus
SetActiveWindow
GetWindowTextLengthA
GetWindowTextA
GetWindowRect
GetClientRect
TranslateMessage
DispatchMessageA
CharUpperBuffA
DialogBoxParamA
GetActiveWindow
SetLastErrorEx
GetWindowLongA
CallWindowProcA
DefWindowProcA
CharNextA
wvsprintfA
SetTimer
LoadCursorFromFileA
CharLowerBuffA
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxA
UnregisterClassA
SetWindowLongA
RegisterClassExA
LoadCursorA
wsprintfA
GetClassInfoExA
LoadStringA
GetParent
ShowWindow
MoveWindow
SetWindowTextA
CreateWindowExA
SendMessageA
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuA
DrawTextA
CopyRect
GetMenu
AdjustWindowRectEx
SetWindowPos
KillTimer
GetKeyState

gdi32

GetTextExtentPoint32A
SelectObject
ExtTextOutA
SetBkMode
CreateRectRgn
GetTextMetricsA
CreateBrushIndirect
CreateRectRgnIndirect
CreatePatternBrush
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
GetTextExtentPointA
GetStockObject
GetObjectA
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontA

shell32

DragQueryFileA
ShellExecuteA
SHEmptyRecycleBinA
SHAddToRecentDocs

ole32

CLSIDFromString
CLSIDFromProgID
OleInitialize
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
RegisterDragDrop
ReleaseStgMedium
StringFromGUID2
OleUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleLockRunning
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysFreeString
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VarBstrCmp
SysAllocString
VariantInit
SysStringByteLen
VariantClear
UnRegisterTypeLi
LoadTypeLi
OleCreateFontIndirect
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantChangeType
VarUI4FromStr
RegisterTypeLi
VarBstrCat

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg

Sections

.text
Size: 668KB - Virtual size: 665KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fe1aea8ce9b74ea4e2e3fe85637d80d

Headers

File Characteristics

Imports

wininet

shlwapi

winmm

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 668KB - Virtual size: 665KB

.rdata Size: 124KB - Virtual size: 121KB

.data Size: 20KB - Virtual size: 28KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 668KB - Virtual size: 665KB

.rdata
Size: 124KB - Virtual size: 121KB

.data
Size: 20KB - Virtual size: 28KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 44KB - Virtual size: 42KB