37f1d95cb7720622ca96ceb85b69eefa

Sharing

Copy URL Twitter E-mail

General

Target

37f1d95cb7720622ca96ceb85b69eefa
Size

2.5MB
MD5

37f1d95cb7720622ca96ceb85b69eefa
SHA1

4a21947897b2b5470c7b9c5fa492bb3b0218f89d
SHA256

a11342af57cf132e1767da4698266f7a100769e3abd353ec8cd15798b34eee4b
SHA512

4863b55965dc8460dc945c221b2219573f4aaa2e7e716b89e14f86cbe386d233e94014f76f53f59f9254471611eba8f5584ca950a9f0f7fd2f394b97460925d6
SSDEEP

49152:H/b93OZT1tevIcxa+z9r87hm22AO3rpqaTPzKzkpmPa6FXfOhj:f1iqdzl87Y22AtAKzF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37f1d95cb7720622ca96ceb85b69eefa

Files

37f1d95cb7720622ca96ceb85b69eefa
.dll windows:6 windows x86 arch:x86

80a8d332beecb8122875f9fdcbd48940

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetDriveTypeA
K32GetModuleFileNameExW
GlobalAlloc
TerminateThread
CreateEventA
GetExitCodeProcess
TerminateProcess
ReadFile
CreateFileW
lstrlenW
SetThreadPriority
GlobalUnlock
GetStdHandle
CreateNamedPipeA
GetProcessWorkingSetSize
MoveFileA
K32EnumProcesses
CreatePipe
WaitForMultipleObjects
GetThreadPriority
CreateMutexA
BuildCommDCBA
GetShortPathNameW
OutputDebugStringA
ReleaseMutex
GetDiskFreeSpaceExA
SuspendThread
ResumeThread
CreateThread
FormatMessageA
SetFilePointer
SystemTimeToFileTime
SetFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
GetFileSize
GetFileInformationByHandle
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetOverlappedResult
SetLastError
EnterCriticalSection
ResetEvent
DeviceIoControl
CancelIo
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
FindFirstFileW
FindNextFileW
DeleteFileW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
GetFileAttributesW
CreateProcessW
ExpandEnvironmentStringsW
SetEndOfFile
GetTickCount64
InitializeCriticalSectionEx
VerSetConditionMask
SleepEx
VerifyVersionInfoA
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
ExpandEnvironmentStringsA
GlobalFree
GetComputerNameA
GetLogicalDriveStringsW
SetConsoleMode
ReadConsoleInputA
SetCurrentDirectoryA
GetCommState
GetModuleHandleA
K32EnumProcessModules
SetCommState
ReadDirectoryChangesW
ConnectNamedPipe
SetEvent
WaitForSingleObject
GetSystemTime
GlobalLock
GlobalMemoryStatus
GetVersion
LocalFree
lstrlenA
GetFullPathNameA
SetEnvironmentVariableA
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
WriteConsoleW
OutputDebugStringW
MoveFileExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadConsoleW
SetStdHandle
FindFirstFileExW
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
CreateProcessA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetTickCount
DeleteFileA
LockResource
LoadLibraryA
CopyFileA
GetSystemDirectoryA
SizeofResource
Sleep
WriteFile
LoadResource
FreeLibrary
AllocConsole
FreeResource
FindResourceA
FindNextFileA
FindClose
GetProcAddress
FindFirstFileA
LoadLibraryW
VirtualQuery
Process32First
GetNativeSystemInfo
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetLocalTime
FlushFileBuffers
GetModuleFileNameW
GetTimeZoneInformation
GetOEMCP
GetACP
IsValidCodePage
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
UnhandledExceptionFilter
GetCPInfo
RaiseException
SetFilePointerEx
DuplicateHandle
GetTempPathA
RtlUnwind
GetProcessHeap
LoadLibraryExW
ExitThread
GetCommandLineA
SystemTimeToTzSpecificLocalTime
UnlockFileEx
LockFileEx
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
AreFileApisANSI
GetModuleHandleExW
ExitProcess
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
GetStringTypeW
DecodePointer
EncodePointer
SetEnvironmentVariableW
FlushConsoleInputBuffer
K32GetModuleBaseNameW
GetCurrentProcess
SetUnhandledExceptionFilter
CreateFileA
QueryPerformanceFrequency
QueryPerformanceCounter
FileTimeToLocalFileTime
CloseHandle
CreateToolhelp32Snapshot
Process32Next
lstrcmpiA
FileTimeToSystemTime
OpenProcess
GetProcessTimes
RemoveDirectoryW

user32

CloseClipboard
GetClassNameA
GetWindowRect
SendInput
IsWindowVisible
MessageBoxW
OpenClipboard
SetWindowLongA
ShowWindow
EnumChildWindows
SetWindowPos
GetWindowLongA
DestroyWindow
GetProcessWindowStation
GetUserObjectInformationW
GetWindowTextW
GetClipboardData
TileWindows
GetForegroundWindow
EnumWindows
SendMessageA
WaitForInputIdle
MessageBeep
GetParent
SetForegroundWindow
CallWindowProcA
EmptyClipboard
SetClipboardData
CreateWindowExA
GetDesktopWindow
DefWindowProcA
FindWindowA
SetWindowTextW
VkKeyScanA
PostMessageA
GetWindowThreadProcessId
MoveWindow
GetWindowModuleFileNameW
MessageBoxA
ShowWindowAsync

advapi32

DuplicateTokenEx
ReportEventA
DeregisterEventSource
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExW
RegFlushKey
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExA
RegCreateKeyExA
RevertToSelf
ImpersonateLoggedOnUser
OpenSCManagerA
QueryServiceStatus
RegOpenKeyExA
StartServiceA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
OpenServiceA
CreateServiceW
RegisterEventSourceA

shell32

ShellExecuteW
SHGetFolderPathA

oleaut32

SysAllocString
SysFreeString
VariantClear

psapi

GetModuleFileNameExA

dbghelp

MiniDumpWriteDump
MakeSureDirectoryPathExists

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

shlwapi

PathAppendA
PathFindFileNameA

ws2_32

htons
WSACleanup
WSAStartup
ntohs
ntohl
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
WSAAddressToStringA
getsockopt
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
inet_addr
gethostbyname
inet_ntoa
getsockname
shutdown

mpr

WNetGetConnectionW

winmm

timeGetTime

crypt32

PFXExportCertStoreEx
CertFindCertificateInStore
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CertGetCertificateChain

rpcrt4

UuidCreateSequential

winhttp

WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpConnect
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo
SendARP

Exports

Exports

Ext_RunDLL
_Ext_RunDLL@16
luaopen_winapi
pcre2_code_copy_8
pcre2_code_copy_with_tables_8
pcre2_code_free_8
pcre2_compile_8
pcre2_compile_context_copy_8
pcre2_compile_context_create_8
pcre2_compile_context_free_8
pcre2_convert_context_copy_8
pcre2_convert_context_create_8
pcre2_convert_context_free_8
pcre2_general_context_copy_8
pcre2_general_context_create_8
pcre2_general_context_free_8
pcre2_get_mark_8
pcre2_get_ovector_count_8
pcre2_get_ovector_pointer_8
pcre2_get_startchar_8
pcre2_jit_compile_8
pcre2_jit_free_unused_memory_8
pcre2_jit_match_8
pcre2_jit_stack_assign_8
pcre2_jit_stack_create_8
pcre2_jit_stack_free_8
pcre2_match_8
pcre2_match_context_copy_8
pcre2_match_context_create_8
pcre2_match_context_free_8
pcre2_match_data_create_8
pcre2_match_data_create_from_pattern_8
pcre2_match_data_free_8
pcre2_set_bsr_8
pcre2_set_callout_8
pcre2_set_character_tables_8
pcre2_set_compile_extra_options_8
pcre2_set_compile_recursion_guard_8
pcre2_set_depth_limit_8
pcre2_set_glob_escape_8
pcre2_set_glob_separator_8
pcre2_set_heap_limit_8
pcre2_set_match_limit_8
pcre2_set_max_pattern_length_8
pcre2_set_newline_8
pcre2_set_offset_limit_8
pcre2_set_parens_nest_limit_8
pcre2_set_recursion_limit_8
pcre2_set_recursion_memory_management_8

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 504KB - Virtual size: 504KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80a8d332beecb8122875f9fdcbd48940

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

psapi

dbghelp

wininet

version

shlwapi

ws2_32

mpr

winmm

crypt32

rpcrt4

winhttp

iphlpapi

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 504KB - Virtual size: 504KB

.data Size: 45KB - Virtual size: 92KB

.rsrc Size: 192KB - Virtual size: 192KB

.reloc Size: 85KB - Virtual size: 84KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 504KB - Virtual size: 504KB

.data
Size: 45KB - Virtual size: 92KB

.rsrc
Size: 192KB - Virtual size: 192KB

.reloc
Size: 85KB - Virtual size: 84KB