e73d3c8e909f16a726e10f6b96386875d84c5c38300179477e6327c2e19b6c4b

Sharing

Copy URL Twitter E-mail

General

Target

e73d3c8e909f16a726e10f6b96386875d84c5c38300179477e6327c2e19b6c4b
Size

317KB
MD5

bc6e3a00350511ebc6e65ac9db4488ae
SHA1

ef219daf8fce77a904a2e9d63e6165c83885f488
SHA256

e73d3c8e909f16a726e10f6b96386875d84c5c38300179477e6327c2e19b6c4b
SHA512

e0799a3b17b26422990252f411a9b0647f61b7c185a1e342749f9ecee4b8165b5d2040eb64cfd60bf18516a71026064ca5e829a1e969dd8d559c1d149a203c88
SSDEEP

6144:uNsStdxDaZM+eV1pRT0wXdTz6KEp+aURDVCOwvbmWp2dbTpcjnpgSd:uftLaZM+sDowXthUURxUbn2hT6jnpgSd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e73d3c8e909f16a726e10f6b96386875d84c5c38300179477e6327c2e19b6c4b

Files

e73d3c8e909f16a726e10f6b96386875d84c5c38300179477e6327c2e19b6c4b
.dll windows:5 windows x86 arch:x86

6a2bce02fc6277ae3029a9d12be051b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
SetFileAttributesA
SetFileAttributesW
MoveFileA
GetProcAddress
GetModuleHandleW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetTempPathA
GetCurrentThreadId
GetCurrentProcessId
FindClose
FindFirstFileA
FindFirstFileW
GetModuleHandleA
GetFileAttributesA
GetFileAttributesW
CreateFileA
GetFileSize
SetFilePointer
SetEndOfFile
VirtualFree
VirtualAlloc
GetVersionExA
ResumeThread
GetNativeSystemInfo
IsWow64Process
VirtualAllocEx
WriteProcessMemory
WaitForSingleObject
VirtualFreeEx
OpenProcess
FindResourceA
SizeofResource
LoadResource
LockResource
FreeResource
GetTempFileNameA
GetFullPathNameW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapDestroy
RaiseException
HeapSize
DecodePointer
DeleteCriticalSection
FindResourceW
FindResourceExW
GetCurrentProcess
QueryDosDeviceW
GetModuleHandleExA
CreateProcessA
SetFileTime
TerminateProcess
FlushFileBuffers
Sleep
PeekNamedPipe
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemTimeAsFileTime
VirtualQueryEx
VirtualProtectEx
ReadProcessMemory
LocalFree
GetThreadContext
SetThreadContext
SetErrorMode
GetHandleInformation
GetProcessId
FlushInstructionCache
SuspendThread
SetEnvironmentVariableA
GetFileAttributesExW
CreateFileW
SetLastError
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryW
LoadLibraryA
LoadLibraryExW
FreeLibrary
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
WriteFile
GetStdHandle
ReadFile
GetLastError
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetOEMCP
GetACP
IsValidCodePage
GetConsoleCP
GetFileType
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
GetFileInformationByHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SendMessageA
GetWindowThreadProcessId
GetMessageA
PostMessageA
wsprintfW
CharUpperA
CharUpperW
IsWindow

advapi32

CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegFlushKey
RegOpenKeyExA
CryptGenRandom
OpenSCManagerA
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
ControlService
ChangeServiceConfigA
QueryServiceStatusEx
OpenServiceA

shell32

SHFileOperationA
CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocStringLen
VariantChangeType
VariantInit
SysFreeString
SysAllocString

shlwapi

PathFileExistsA
PathRemoveFileSpecA

ntdll

RtlImageNtHeader
RtlAdjustPrivilege
RtlWriteRegistryValue
RtlUnwind
RtlImageDirectoryEntryToData
RtlInitUnicodeString
RtlCreateRegistryKey
NtLoadDriver

wintrust

CryptCATAdminReleaseContext
CryptCATAdminAddCatalog
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminRemoveCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext

ws2_32

htons
inet_addr
ntohl

Exports

Exports

AddPayload
AppendData
BufDec
BunzB
BunzF
BunzF2
CheckMySign
ChkSecu
ChkSecuN
ClearEnv
CreateInRunBuf
DataCodec
DataConv
FWAdd
FWOpt
GetFunStr
GetProcArch
GetProcArchN
GetRandStr
GetReg
GetRegInt
GetRegStr
GetTempFpa
HashFile
HashFinal
HashInit
HashProcess
HashStr
ImpHash
InRunBuf
InRunBufH
InRunBufN
LdrSysMod
MyFree
ParseAddress
ReadFileBuff
RunBufEx
RunBufRaw
RunBufRawEx
RundllInstallA
SendBuf
SetReg
SetRegInt
SetRegStr
SetSecu
StartNt
TestUnz
UnzB
Unzip
UnzipEx
UnzipEx2
Verify
VerifyDrvSign
VerifySig
VerifySigB
Version
WriteFileBuff

Sections

.text
Size: - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cry0
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cry1
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a2bce02fc6277ae3029a9d12be051b5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

wintrust

ws2_32

Exports

Exports

Sections

.text Size: - Virtual size: 399KB

.rdata Size: - Virtual size: 68KB

.data Size: - Virtual size: 20KB

.cry0 Size: - Virtual size: 13KB

.cry1 Size: 311KB - Virtual size: 310KB

.reloc Size: 512B - Virtual size: 152B

.rsrc Size: 1KB - Virtual size: 5KB

.text
Size: - Virtual size: 399KB

.rdata
Size: - Virtual size: 68KB

.data
Size: - Virtual size: 20KB

.cry0
Size: - Virtual size: 13KB

.cry1
Size: 311KB - Virtual size: 310KB

.reloc
Size: 512B - Virtual size: 152B

.rsrc
Size: 1KB - Virtual size: 5KB