370bb711692948d2ca015b238cc7735b

Sharing

Copy URL Twitter E-mail

General

Target

370bb711692948d2ca015b238cc7735b
Size

1.8MB
MD5

370bb711692948d2ca015b238cc7735b
SHA1

ccbf55983ddbb05b26e377c7a8433212b1ebb552
SHA256

e8ac78e4d921698f0da6b911dca3b80a22bc0777c56358aa6f0ff8c399ac891a
SHA512

c1f4b2ff96895fa61d3581e158e53be78b6106903e26815654dfe08ec2ab807912b552505bdb0dba125eb52d07aaad9982bc7282d828565ef2539f6908a57ebc
SSDEEP

24576:tObQ4dRDlmaxxCEznipVJ7gfplhlVXzPJmmL1HmoD0aEyW3J09ArLXMRRuf24AQv:gQYoRpE75m53rfXMRRufYQHP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
370bb711692948d2ca015b238cc7735b

Files

370bb711692948d2ca015b238cc7735b
.dll windows:4 windows x86 arch:x86

ec0609f784486d975e1aff6b9b4f70ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetTickCount
InterlockedExchange
CreateMutexA
CloseHandle
WaitForSingleObject
ReleaseMutex
CreateFileA
WriteFile
lstrcpyA
GlobalMemoryStatus
LoadLibraryA
FreeLibrary
GetProcAddress
FormatMessageA
LocalFree
lstrcmpA
GetLastError
LocalAlloc
GetFileSize
ReadFile
CreateDirectoryA

advapi32

CryptAcquireContextA
CryptGetUserKey
CryptExportKey
CryptDestroyKey
CryptReleaseContext

wsock32

gethostbyname
ntohl
htonl
select
__WSAFDIsSet
recv
send
WSAStartup
socket
WSAGetLastError
ioctlsocket
htons
connect
closesocket
inet_addr

crypt32

CertEnumCertificatesInStore
PFXImportCertStore
CryptDecodeObjectEx
CertDuplicateCertificateContext
CertDuplicateStore
CertGetCertificateContextProperty
CertGetIssuerCertificateFromStore
CertFindCertificateInStore
CertCreateCertificateContext
CertOpenSystemStoreA
CertAddCertificateContextToStore
CertCloseStore
CertFreeCertificateContext

wininet

HttpSendRequestA
InternetCloseHandle
InternetReadFile
InternetConnectA
InternetOpenA
HttpQueryInfoA
HttpOpenRequestA
InternetErrorDlg

nsldap32v50

ord51
ord26
ord32
ord35
ord200
ord201
ord79
ord41
ord85
ord418
ord13
ord22
ord60

mfc42

ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord269
ord1116
ord825
ord823
ord800
ord535
ord860
ord540
ord1601
ord537
ord539

msvcrt

__dllonexit
__CxxFrameHandler
malloc
isxdigit
atoi
free
_memicmp
strstr
tolower
sprintf
strncmp
calloc
isalnum
memset
memcpy
strlen
isdigit
gmtime
mktime
_ftime
time
clock
rand
_getpid
realloc
printf
sscanf
vsprintf
strncpy
fclose
strtok
fgets
fopen
_unlink
localtime
strftime
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
atol
_onexit

user32

GetMessageTime
GetFocus
GetCursorPos

Exports

Exports

DSTK_API_Finish
DSTK_API_GetErrInfo
DSTK_API_GetInfo
DSTK_API_Init
DSTK_API_SetConfFile
DSTK_API_SetHashAlgo
DSTK_BASE64_Decode
DSTK_BASE64_Encode
DSTK_BINSTR_Create
DSTK_BINSTR_Delete
DSTK_BINSTR_SetData
DSTK_CERT_AddTrustedCert
DSTK_CERT_GetAIA
DSTK_CERT_GetAuthKeyID
DSTK_CERT_GetBasicConstraints
DSTK_CERT_GetCRLDP
DSTK_CERT_GetCRLDP_URL
DSTK_CERT_GetCertPolicy
DSTK_CERT_GetCertPolicy_PolicyID
DSTK_CERT_GetExtKeyUsage
DSTK_CERT_GetIssuerAltName
DSTK_CERT_GetIssuerName
DSTK_CERT_GetKeyUsage
DSTK_CERT_GetPolicyConstraints
DSTK_CERT_GetPubKey
DSTK_CERT_GetPubKey2
DSTK_CERT_GetSerialNum
DSTK_CERT_GetSerialNum2
DSTK_CERT_GetSignature
DSTK_CERT_GetSignature2
DSTK_CERT_GetSignatureAlgorithm
DSTK_CERT_GetSubKeyID
DSTK_CERT_GetSubjectAltName
DSTK_CERT_GetSubjectName
DSTK_CERT_GetSubjectName_DERFormat
DSTK_CERT_GetValidity
DSTK_CERT_GetValidity2
DSTK_CERT_GetVersion
DSTK_CERT_Load
DSTK_CERT_SetCaPubs
DSTK_CERT_SetVerifyEnv1
DSTK_CERT_SetVerifyEnv2
DSTK_CERT_Unload
DSTK_CERT_Verify
DSTK_CERT_Verify2
DSTK_CMP_CertRecovery
DSTK_CMP_CertRequest
DSTK_CMP_CertRequest2
DSTK_CMP_CertRevoke
DSTK_CMP_CertRevoke2
DSTK_CMP_CertUpdate
DSTK_CMP_CertUpdate2
DSTK_CMP_SetCA
DSTK_CMP_SetProtocol
DSTK_CMS_AddSigner
DSTK_CMS_DecryptData
DSTK_CMS_DecryptFile
DSTK_CMS_EncryptData
DSTK_CMS_EncryptDataWithMultiReps
DSTK_CMS_EncryptFile
DSTK_CMS_GetSignerCert
DSTK_CMS_GetSignerCert1
DSTK_CMS_SignAndEncData
DSTK_CMS_SignData
DSTK_CMS_SignFile
DSTK_CMS_VerifyAndDecData
DSTK_CMS_VerifyData
DSTK_CMS_VerifyFile
DSTK_CRYPT_AsymDecrypt
DSTK_CRYPT_AsymEncrypt
DSTK_CRYPT_Decrypt
DSTK_CRYPT_Encrypt
DSTK_CRYPT_GenKeyAndIV
DSTK_CRYPT_GenKeyPair
DSTK_CRYPT_GenMAC
DSTK_CRYPT_GenMAC2
DSTK_CRYPT_GenRandom
DSTK_CRYPT_GenSharedKey
DSTK_CRYPT_GetChangedKeyAndIV
DSTK_CRYPT_GetKeyAndIV
DSTK_CRYPT_Hash
DSTK_CRYPT_HashFile
DSTK_CRYPT_SetChangedKeyAndIV
DSTK_CRYPT_SetEnvChangeIV
DSTK_CRYPT_SetKeyAndIV
DSTK_CRYPT_SetPaddingType
DSTK_CRYPT_SetRSAVersion
DSTK_CRYPT_Sign
DSTK_CRYPT_Verify
DSTK_CRYPT_VerifyMAC
DSTK_CRYPT_VerifyMAC2
DSTK_DSAP_GetCRLByCert
DSTK_DSAP_GetDataByURL
DSTK_MEDIA_CARD_DeleteCert
DSTK_MEDIA_CARD_DeletePriKey
DSTK_MEDIA_CARD_ReadCert
DSTK_MEDIA_CARD_ReadPriKey
DSTK_MEDIA_CARD_WriteCert
DSTK_MEDIA_CARD_WritePriKey
DSTK_MEDIA_DISK_DeleteCert
DSTK_MEDIA_DISK_DeletePriKey
DSTK_MEDIA_DISK_ReadCert
DSTK_MEDIA_DISK_ReadFile
DSTK_MEDIA_DISK_ReadPriKey
DSTK_MEDIA_DISK_WriteCert
DSTK_MEDIA_DISK_WriteFile
DSTK_MEDIA_DISK_WritePriKey
DSTK_MEDIA_Load
DSTK_MEDIA_Unload
DSTK_MEDIA_WINS_GetCertCnt
DSTK_MEDIA_WINS_GetCertDN
DSTK_MEDIA_WINS_ReadCaPubs
DSTK_MEDIA_WINS_ReadCert
DSTK_MEDIA_WINS_ReadPriKey
DSTK_MEDIA_WINS_WriteCert
DSTK_MEDIA_WINS_WriteCertAndPriKey
DSTK_OCSP_CheckCertStatus
DSTK_PEM_Decode
DSTK_PEM_Encode
DSTK_PFX_Export
DSTK_PFX_Export2
DSTK_PFX_ExportMultiPair
DSTK_PFX_ExportMultiPair2
DSTK_PFX_Import
DSTK_PFX_ImportMultiPair
DSTK_PFX_ImportMultiPair2
DSTK_PKCS11_CMP_CertRequest
DSTK_PKCS11_CMP_CertRevoke
DSTK_PKCS11_CMP_CertUpdate
DSTK_PKCS11_CMP_CertUpdate2
DSTK_PKCS11_ChangePIN
DSTK_PKCS11_CloseSession
DSTK_PKCS11_Decrypt
DSTK_PKCS11_DecryptData
DSTK_PKCS11_DeleteCertAndPriKey
DSTK_PKCS11_Encrypt
DSTK_PKCS11_GenKeyPair
DSTK_PKCS11_GetCertCnt
DSTK_PKCS11_GetCertInfo
DSTK_PKCS11_GetSlotList
DSTK_PKCS11_GetTokenInfo
DSTK_PKCS11_InitToken
DSTK_PKCS11_InitTokenWithSlotID
DSTK_PKCS11_Login
DSTK_PKCS11_Logout
DSTK_PKCS11_OpenSession
DSTK_PKCS11_OpenSessionWithSlotID
DSTK_PKCS11_OpenSessionWithTokenName
DSTK_PKCS11_ReadCert
DSTK_PKCS11_ReadRandomForVID
DSTK_PKCS11_Sign
DSTK_PKCS11_SignAndEnvData
DSTK_PKCS11_SignData
DSTK_PKCS11_SignData_NoContent
DSTK_PKCS11_Verify
DSTK_PKCS11_VerifyAndDecData
DSTK_PKCS11_VerifySignatureValue
DSTK_PKCS11_WriteCertAndPriKey
DSTK_PRIKEY_ChangePasswd
DSTK_PRIKEY_CheckKeyPair
DSTK_PRIKEY_Decrypt
DSTK_PRIKEY_Encrypt
DSTK_PRIKEY_GetPriKeyInfo
DSTK_TSP_GetTokenInfo
DSTK_TSP_GetTokenInfo2
DSTK_TSP_TimeStampData
DSTK_TSP_TimeStampFile
DSTK_TSP_VerifyToken
DSTK_TSP_VerifyToken2
DSTK_UNI_DecryptEnvData
DSTK_UNI_VerifySignData
DSTK_UNI_ViewCert
DSTK_UTIL_AddObject
DSTK_UTIL_CompareDN
DSTK_UTIL_GetCertPath
DSTK_UTIL_GetObject
DSTK_UTIL_GetObjectCount
DSTK_UTIL_GetRootCert
DSTK_UTIL_IsTrustCert
DSTK_VID_GetRandomFromPriKey
DSTK_VID_Verify
DSTK_WPKI_DecryptData
DSTK_WPKI_EncryptData
DSTK_WPKI_SignData
DSTK_WPKI_VerifyCert
DSTK_WPKI_VerifyData

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec0609f784486d975e1aff6b9b4f70ac

Headers

File Characteristics

Imports

kernel32

advapi32

wsock32

crypt32

wininet

nsldap32v50

mfc42

msvcrt

user32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 96KB - Virtual size: 92KB

.data Size: 236KB - Virtual size: 238KB

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 104KB - Virtual size: 101KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 96KB - Virtual size: 92KB

.data
Size: 236KB - Virtual size: 238KB

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 104KB - Virtual size: 101KB