4725fd7f2e16ed6fe5ada1077dcec276

Sharing

Copy URL Twitter E-mail

General

Target

4725fd7f2e16ed6fe5ada1077dcec276
Size

109KB
MD5

4725fd7f2e16ed6fe5ada1077dcec276
SHA1

bf64e15b1033abfc89224d9eda9b20b12b5634d1
SHA256

7911cb80cd342b185fe116c402424bc617d3702d475e9aa2f4d4796044b7bf73
SHA512

52f11d2ced80154de5f9b5d1de44b7421cc59a33a43fa9cfc93049cb7ef3a2c8658bddde9737c4a9e593afd5b99d189c54d1b94364f9d27c9866699ef1e74c2a
SSDEEP

3072:8mSK+SqtO3QJ1pIeJ++OoSoNJF1w87gO:aKAtOMgjod1v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4725fd7f2e16ed6fe5ada1077dcec276

Files

4725fd7f2e16ed6fe5ada1077dcec276
.dll regsvr32 windows:4 windows x86 arch:x86

ed16731dcf2cfd9d02d61fa96abead53

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

lz32

LZOpenFileA
LZClose
LZCopy

kernel32

GetUserDefaultLCID
WriteFile
GetFileSize
SetFilePointer
GetFileTime
lstrlenA
SetFileTime
GetCurrentDirectoryA
IsBadReadPtr
VirtualProtect
WaitForSingleObject
GetTempFileNameA
GetVersionExA
ResetEvent
InterlockedIncrement
DisableThreadLibraryCalls
lstrlenW
CreateMutexA
ReleaseMutex
FileTimeToSystemTime
GetSystemTime
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetCurrentDirectoryA
MultiByteToWideChar
WideCharToMultiByte
HeapDestroy
RtlUnwind
InterlockedDecrement
lstrcpyA
GetEnvironmentVariableA
GetTickCount
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetSystemDirectoryA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
CopyFileA
CreateFileA
ReadFile
GetTempPathA
GetFileAttributesA
CreateDirectoryA
CloseHandle
InitializeCriticalSection
GetModuleHandleA
GetWindowsDirectoryA
GetCurrentProcessId
SetEvent
OpenEventA
CreateEventA
Sleep
ResumeThread
GetCurrentThreadId
GetLastError
SetThreadPriority

user32

IsChild
GetParent
GetClientRect
GetSystemMetrics
IsWindow
ScreenToClient
DialogBoxParamA
EndDialog
SendDlgItemMessageA
LoadImageA
LoadCursorFromFileA
CopyIcon
CopyImage
SetSystemCursor
DestroyCursor
MessageBoxA
PostMessageA
LoadStringA
wsprintfA
KillTimer
SetTimer
GetScrollInfo
SetClassLongA
GetWindowThreadProcessId
GetClassLongA
SetWindowsHookExA
UnhookWindowsHookEx
LoadCursorA
SetCursor
CallNextHookEx
SetScrollPos
DestroyMenu
RemoveMenu
TrackPopupMenu
SetMenuItemBitmaps
CreateMenu
ReleaseDC
GetDC
AppendMenuA
GetMenuItemCount
EnableMenuItem
CheckMenuItem
GetClassNameA
GetCursorPos
WindowFromPoint
DrawIconEx
GetWindow
GetWindowLongA
GetSysColor

ole32

StringFromCLSID
CoTaskMemFree

oleaut32

VariantClear
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VariantCopy
SysAllocString
VariantInit
SysFreeString

advapi32

EqualSid
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegCloseKey
FreeSid
AllocateAndInitializeSid

gdi32

DeleteObject
PatBlt
SelectObject
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC

msvcrt20

isalnum
wcstombs
free
mbstowcs
atol
strtok
atoi
isspace
_strlwr
memcmp
atan2
abs
_beginthreadex
_itoa
gmtime
sscanf
_beginthread
realloc
fwrite
malloc
_setmode
fseek
fopen
fread
fclose
strncmp
_purecall
srand
floor
??3@YAXPAX@Z
sin
??2@YAPAXI@Z
memset
strncpy
strncat
strchr
strcat
strlen
strcpy
memcpy
rand
_ftol
_stricmp
strstr
_getpid
time
strcmp

Exports

Exports

?CompareVersionString@@YGHPAD@Z
Chill
CompareProductVersion
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ExtCDC
ExtDPN
ExtDPS
ExtInit
ExtRDC
ExtSDC
GEH
REH
SelfReg
SetNavPfn
SetPageLoadedPfn
SetPageLocation
SetVersionString

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.myseg
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed16731dcf2cfd9d02d61fa96abead53

Headers

File Characteristics

Imports

version

lz32

kernel32

user32

ole32

oleaut32

advapi32

gdi32

msvcrt20

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 5KB - Virtual size: 6KB

.myseg Size: 2KB - Virtual size: 2KB

.rsrc Size: 10KB - Virtual size: 12KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 5KB - Virtual size: 6KB

.myseg
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 10KB - Virtual size: 12KB

.reloc
Size: 6KB - Virtual size: 6KB