351e4dbe6933012cb03e0bada0b2e471e63dc3b7487700de6b11e08dbb3892fb

Sharing

Copy URL Twitter E-mail

General

Target

351e4dbe6933012cb03e0bada0b2e471e63dc3b7487700de6b11e08dbb3892fb
Size

5.3MB
MD5

f30a73e3dc7f37e13ddc4d150d88103c
SHA1

86b13088b844a8e4e739c7697b89cb4205608234
SHA256

351e4dbe6933012cb03e0bada0b2e471e63dc3b7487700de6b11e08dbb3892fb
SHA512

6cc5658eab443d422fb534766beaab49702b0e8fab4973be1215c28a2bc98c4e63f850221a7b174669db4549b9f8cfdc58d8f9bb5298156b899b4b40793708c2
SSDEEP

49152:C4t4tn/JtjjbcGjL2Z9faQtvMkEY/RIeGufFLmbsq33/B46OMGcOb3SUwKsBZVpg:ABdjJoIg/RIeGufFLmb/36SLMMrMmr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
351e4dbe6933012cb03e0bada0b2e471e63dc3b7487700de6b11e08dbb3892fb

Files

351e4dbe6933012cb03e0bada0b2e471e63dc3b7487700de6b11e08dbb3892fb
.dll windows:6 windows x86 arch:x86

ef0cbf53ecae8f22dbfadab4426acb47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringW
GetCurrentThreadId
QueryPerformanceCounter
OpenProcess
GetFileAttributesExW
GetCommandLineW
GetTempFileNameW
GetLongPathNameW
SearchPathW
FormatMessageW
LocalFree
LoadLibraryW
GetProcAddress
FreeLibrary
QueryPerformanceFrequency
GetVersionExW
CreateProcessW
GetTempPathW
GetDiskFreeSpaceExW
CreateThread
GetExitCodeThread
GetExitCodeProcess
GetCurrentProcess
TerminateThread
OpenEventW
ResetEvent
GetLocalTime
GetSystemTime
GetFileAttributesW
CreateDirectoryW
GetShortPathNameW
GetFileSizeEx
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
PeekNamedPipe
GetEnvironmentVariableW
TryEnterCriticalSection
WaitForMultipleObjects
CreatePipe
GetStartupInfoW
GlobalMemoryStatusEx
FlushViewOfFile
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetUserDefaultLCID
GetLocaleInfoW
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
GetComputerNameExW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFilePointer
LocalAlloc
ProcessIdToSessionId
GlobalLock
GlobalUnlock
GetFileTime
DeviceIoControl
GetSystemDirectoryW
MoveFileExW
CopyFileW
SetFileAttributesW
VerifyVersionInfoW
lstrcmpiW
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
MoveFileW
GetPrivateProfileStringW
GetPrivateProfileStringA
WritePrivateProfileStringW
WritePrivateProfileStringA
CreateSemaphoreW
ReleaseSemaphore
lstrcpyW
lstrcatW
GetFileSize
FlushFileBuffers
lstrlenW
GetACP
FreeResource
GetDateFormatW
GetTimeFormatW
InterlockedCompareExchange
SetErrorMode
GetStringTypeW
EncodePointer
IsDebuggerPresent
ExitThread
LoadLibraryExW
GetCommandLineA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
IsValidCodePage
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetStdHandle
FileTimeToLocalFileTime
GetFileInformationByHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
FormatMessageA
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetCurrentProcessId
InitializeCriticalSection
ExpandEnvironmentStringsW
GetModuleFileNameW
FindResourceW
UnmapViewOfFile
OpenMutexW
OpenFileMappingW
ReleaseMutex
CreateMutexW
MapViewOfFile
CreateFileMappingW
FindResourceExW
LoadResource
LockResource
SizeofResource
WaitForSingleObject
SetEvent
CreateEventW
DeleteFileW
SetThreadExecutionState
CancelIo
GetOverlappedResult
ReadFile
CloseHandle
WriteFile
CreateFileW
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
GetTickCount
HeapAlloc
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
GlobalFree
GlobalAlloc
SetLastError
Sleep
GetUserDefaultLangID

user32

MsgWaitForMultipleObjectsEx
WaitForInputIdle
GetAsyncKeyState
OpenWindowStationW
CloseWindowStation
GetProcessWindowStation
SetProcessWindowStation
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
CloseDesktop
ExitWindowsEx
AllowSetForegroundWindow
PeekMessageW
TranslateMessage
DispatchMessageW
GetLastActivePopup
IsWindowVisible
ShowWindow
SetForegroundWindow
MsgWaitForMultipleObjects
GetSystemMetrics
SystemParametersInfoW
LoadIconW
DestroyIcon
RegisterWindowMessageW
SetTimer
GetMessageW
SendMessageCallbackW
GetKeyState
wsprintfW
GetDesktopWindow
MessageBoxW
GetActiveWindow

gdi32

ExtEscape
GetBitmapBits
TextOutW
EngCreatePalette
GetStockObject
DeleteDC
CreateSolidBrush
DeleteObject
SetTextAlign
CreateBitmap
GetTextMetricsW
SetBkColor
SetTextColor
SelectObject
CreateFontW
CreateCompatibleDC
CreateICW

winspool.drv

ClosePrinter
SetPrinterW
SetJobW
GetPrinterW
OpenPrinterW
GetJobW
EnumJobsW
DocumentPropertiesW
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
EndDocPrinter
EndPagePrinter
AddPrinterW
DeletePrinter
EnumPrintersW
GetPrinterDataExW
SetPrinterDataExW
AddPrinterDriverW
GetPrinterDriverW
XcvDataW
DeletePrinterDriverExW
GetPrinterDriverDirectoryW
EnumPrinterDriversW
ord204
ord203
AddMonitorW
DeleteMonitorW
EnumMonitorsW
EnumPortsW
StartDocPrinterW
StartPagePrinter
WritePrinter

ole32

GetHGlobalFromStream
FreePropVariantArray
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoInitializeEx
OleUninitialize
OleInitialize
CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
CoInitialize
PropVariantCopy
CoTaskMemAlloc
PropVariantClear
OleRun
CLSIDFromProgID

shlwapi

SHCreateStreamOnFileEx
PathRemoveFileSpecW
PathIsDirectoryW
PathIsFileSpecW
PathFindExtensionW
PathFindFileNameW

netapi32

NetWkstaGetInfo

ws2_32

bind
listen
accept
recv
send
getaddrinfo
WSADuplicateSocketW
WSACloseEvent
closesocket
shutdown
WSAResetEvent
freeaddrinfo
WSAAddressToStringW
WSAStartup
WSAStringToAddressW
WSAEnumNetworkEvents
inet_addr
WSAGetLastError
WSAConnect
WSAEventSelect
WSACreateEvent
getsockopt
gethostbyname
__WSAFDIsSet
socket
htons
select
connect
ioctlsocket
WSACleanup
WSASocketW
setsockopt

psapi

GetModuleFileNameExW
EnumProcesses
GetModuleBaseNameW
EnumProcessModules

secur32

GetUserNameExW

advapi32

RevertToSelf
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
GetUserNameW
CheckTokenMembership
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
StartServiceW
ControlService
QueryServiceConfigW
ChangeServiceConfigW
CreateProcessAsUserW
AllocateAndInitializeSid
FreeSid
OpenEventLogW
CloseEventLog
BackupEventLogW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateToken
ImpersonateLoggedOnUser
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryInfoKeyW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
ExtractIconW
SHGetSpecialFolderPathW

oleaut32

SysFreeString
SysStringLen
VariantInit
VariantClear
DispCallFunc
SafeArrayGetVartype
SysStringByteLen
SysAllocStringByteLen
SafeArrayCopy
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString
SafeArrayDestroy
SafeArrayUnlock
SafeArrayRedim
SafeArrayCreate
SafeArrayLock
GetErrorInfo
VariantChangeType
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayAccessData
VariantCopy

wininet

HttpOpenRequestW
InternetCloseHandle
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
HttpQueryInfoA
InternetConnectW
HttpAddRequestHeadersW
InternetErrorDlg
InternetOpenW
InternetReadFileExA

setupapi

SetupCloseInfFile
CMP_WaitNoPendingInstallEvents
SetupGetLineTextW
SetupFindFirstLineW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiSetClassInstallParamsW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_DevNode_Registry_PropertyW
CM_Set_DevNode_Registry_PropertyW
CM_Disable_DevNode
SetupDiGetClassDevsW
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiCallClassInstaller
SetupDiOpenClassRegKey
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupDiDestroyDriverInfoList
SetupDiRemoveDevice

iphlpapi

IcmpSendEcho
IcmpCreateFile
DeleteIPAddress
AddIPAddress
IpRenewAddress
NotifyAddrChange
IpReleaseAddress
GetInterfaceInfo
GetIfEntry
GetAdaptersAddresses
IcmpCloseHandle
GetAdaptersInfo

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdiplus

GdipGetImageEncoders
GdiplusStartup
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdiplusShutdown
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipAlloc
GdipFree
GdipGetImageWidth
GdipSaveImageToFile
GdipCloneImage
GdipDisposeImage

rpcrt4

UuidCreate
UuidToStringA

crypt32

CertOpenStore
CertAddEncodedCertificateToStore
CertDeleteCertificateFromStore
CertCloseStore
CryptUnprotectData

Exports

Exports

Create_LEDM_Fax_JobFactory
DllCanUnloadNow
DllGetClassObject
RunDLLEntryW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 913KB - Virtual size: 913KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef0cbf53ecae8f22dbfadab4426acb47

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

ole32

shlwapi

netapi32

ws2_32

psapi

secur32

advapi32

shell32

oleaut32

wininet

setupapi

iphlpapi

version

gdiplus

rpcrt4

crypt32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 51KB - Virtual size: 98KB

.rsrc Size: 913KB - Virtual size: 913KB

.reloc Size: 414KB - Virtual size: 413KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 51KB - Virtual size: 98KB

.rsrc
Size: 913KB - Virtual size: 913KB

.reloc
Size: 414KB - Virtual size: 413KB