33715abdf13302b4e38bb97539f308e5

Sharing

Copy URL

Twitter E-mail

General

Target

33715abdf13302b4e38bb97539f308e5
Size

336KB
MD5

33715abdf13302b4e38bb97539f308e5
SHA1

af83d7c029a4cc0c0f79d3220adaae2e5809b538
SHA256

0a4bcb6ccfe422af9e0a55d8accdc0fe03c74a4816d184a9a0574ebebf92dd8a
SHA512

4ef0830570358a96e5f0b3b40ece3c25f43f79090508c744d31b412832c34f905363c02c2efcc8b4ed4bb81dd56e4829a657a894cddf4201aacda8fb8a639cd8
SSDEEP

6144:Asbr6x5a9mpN3argo9oHQqVPJZC/Ake3AmmiP0nWrZ:AsP39mpNvo9owqBz4e3AmRP0Wr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33715abdf13302b4e38bb97539f308e5

Files

33715abdf13302b4e38bb97539f308e5
.dll regsvr32 windows:5 windows x86 arch:x86

c0311540a18bc59a778556eadc5edbd2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
GetUserNameA
QueryServiceStatus
FreeSid
AddAccessAllowedAce
OpenSCManagerA
RegSetValueExA
RegCloseKey
CreateProcessAsUserA
GetLengthSid
InitializeAcl
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExA
OpenServiceA
InitializeSecurityDescriptor
OpenThreadToken
RevertToSelf
SetThreadToken
AllocateAndInitializeSid
CloseServiceHandle
SetSecurityDescriptorDacl

cdosys

DllRegisterServer

cnvfat

IsConversionAvailable

gdi32

GetDCOrgEx
CreateDCA
GetClipBox
DeleteDC
ExtEscape

htui

HTUI_ColorAdjustmentA

imgutil

DitherTo8

kbdaze

KbdLayerDescriptor

kbdhela2

KbdLayerDescriptor

kbdro

KbdLayerDescriptor

kbdtuf

KbdLayerDescriptor

kernel32

SetFilePointer
SetCurrentDirectoryA
TerminateProcess
VirtualFree
GetCurrentProcess
MultiByteToWideChar
GetEnvironmentStringsW
lstrcpyA
GetCurrentThreadId
IsBadWritePtr
GetExitCodeProcess
ReleaseMutex
WaitForMultipleObjects
GetLastError
TerminateThread
OutputDebugStringA
GetStartupInfoA
GetModuleHandleA
CreateProcessA
SetUnhandledExceptionFilter
CallNamedPipeA
ResetEvent
CreateThread
Sleep
HeapDestroy
CreateMutexA
GetStringTypeW
GetSystemInfo
SetConsoleCtrlHandler
QueryPerformanceCounter
GetFileType
GetStringTypeA
GetVersionExA
HeapCreate
GetOEMCP
LCMapStringA
GetACP
GetCPInfo
WriteFile
CreateEventA
FreeEnvironmentStringsA
InterlockedExchange
ExitProcess
RtlUnwind
GetModuleFileNameA
RaiseException
SetEvent
GetStdHandle
HeapReAlloc
UnhandledExceptionFilter
FlushFileBuffers
LoadLibraryW
GetCommandLineA
VirtualProtect
HeapAlloc
VirtualAlloc
SetHandleCount
FreeEnvironmentStringsW
SetStdHandle
IsBadCodePtr
LoadLibraryA
VirtualProtectEx
GetProcAddress
CloseHandle
GetTickCount
ReadFile
HeapFree
GetProcessHeap
GetEnvironmentStrings
LCMapStringW
FreeLibrary
GetLocaleInfoA
GetCurrentThread
WideCharToMultiByte
GetCurrentProcessId
WaitForSingleObject
OpenEventA
IsBadReadPtr
VirtualQuery

ole32

StringFromGUID2
CoCreateInstance
CoInitializeEx
CoUninitialize

setupapi

SetupDiGetDeviceRegistryPropertyA
CM_Get_Parent
SetupDiSetClassInstallParamsA
CM_Reenumerate_DevNode
SetupDiEnumDeviceInfo
CM_Get_Device_ID_ExA
SetupDiOpenDevRegKey
SetupDiGetClassDevsA
CM_Get_DevNode_Registry_PropertyA
SetupDiGetDeviceInstanceIdA
SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList

tapisrv

ServiceMain

untfs

Recover

user32

SystemParametersInfoA
CallNextHookEx
SetWindowsHookExA
EnumDisplaySettingsA
IsIconic
GetWindowPlacement
EnumDisplayDevicesA
GetSystemMetrics
GetWindowRect
EnumDisplaySettingsExA
OffsetRect
RegisterDeviceNotificationA
UnhookWindowsHookEx
IntersectRect
ChangeDisplaySettingsExA
UnregisterDeviceNotification

wdigest

CredentialUpdateFree

Exports

Exports

Subconjunctival
Ungladden
Narcissine
DllRegisterServer
Striga
Fatefully
Microphthalmia
Galinsoga
Mulattress
Superinnocent
Tearlessness
Leperdom
Plurinominal
Hearthstone
Ipil
Mudir
Disafforest
Coexclusive
Jovianly
Labelloid
Scenical
Xeres
Unsurnamed
Taxite
Betulites
Lamellule
Patrimonially
Hyperanarchy
Araliophyllum
Morganite
Struthioid
Nucellar
Mozambican
DllUnregisterServer
Nondegreased
Vesania
Montanist
Hexangularly
Inflexed
Nonfarm
Unsurrendered
Myalism
Sunweed
Fennelflower
Palmospasmus
Poultryist
Steelification
Vulgarish
Porchless

Sections

CODE
Size: 134KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 185KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0311540a18bc59a778556eadc5edbd2

Headers

File Characteristics

Imports

advapi32

cdosys

cnvfat

gdi32

htui

imgutil

kbdaze

kbdhela2

kbdro

kbdtuf

kernel32

ole32

setupapi

tapisrv

untfs

user32

wdigest

Exports

Exports

Sections

CODE Size: 134KB - Virtual size: 176KB

.data Size: 185KB - Virtual size: 227KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 10KB - Virtual size: 9KB

CODE
Size: 134KB - Virtual size: 176KB

.data
Size: 185KB - Virtual size: 227KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 10KB - Virtual size: 9KB