0679eebfc218097548d997b4b5bea66e0ee2d8bda636198af85789be44e0f452

Sharing

Copy URL Twitter E-mail

General

Target

0679eebfc218097548d997b4b5bea66e0ee2d8bda636198af85789be44e0f452
Size

2.1MB
MD5

39a51744a96f2461a7d24a143287a055
SHA1

7117d5efbbaf2435664b612609ba9135da59dd26
SHA256

0679eebfc218097548d997b4b5bea66e0ee2d8bda636198af85789be44e0f452
SHA512

a4bacdd0c597ed184761c786e4eb6c945654ae1b152492c151ab82cbd42d2557acc2516864f3c084596718fbdbd45957087307ff8d7b9998da1c6222ac0b5958
SSDEEP

49152:GUvjFnIlZRtlR0A/l+uqhLmjU/HBrQ+b01X:GMIPd+bLm4/HBct

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0679eebfc218097548d997b4b5bea66e0ee2d8bda636198af85789be44e0f452

Files

0679eebfc218097548d997b4b5bea66e0ee2d8bda636198af85789be44e0f452
.dll windows:5 windows x86 arch:x86

ca9fa8a48bbf195cc8f0cf3646b443ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CreateWindowExA
SwitchToThisWindow
EndDeferWindowPos
GetKeyNameTextW
EnumDisplayDevicesW
PostQuitMessage
GetWindowContextHelpId
ExcludeUpdateRgn
GetCaretBlinkTime
TrackPopupMenu
ShowWindow
ChangeClipboardChain
InvalidateRgn
CloseWindow
ActivateKeyboardLayout
GetMenuDefaultItem

wintrust

WintrustRemoveActionID
WinVerifyTrust

ws2_32

WSAGetLastError

urlmon

CoInternetCreateSecurityManager
CopyStgMedium
CoInternetCreateZoneManager

winmm

midiOutGetDevCapsA
timeGetTime
waveOutRestart

winspool.drv

AddPrinterDriverA

iphlpapi

Icmp6SendEcho2

advapi32

RegSaveKeyW

oleaut32

GetErrorInfo
GetRecordInfoFromGuids

comdlg32

GetOpenFileNameA

kernel32

GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
GetLocaleInfoW
GetStringTypeW
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCommandLineA
LCMapStringA
LCMapStringW
CreateFileA
InterlockedIncrement
TlsFree
TlsSetValue
FreeEnvironmentStringsA
GetEnvironmentStrings
GetSystemTimeAsFileTime
SetEvent
BeginUpdateResourceA
VirtualAlloc
GlobalMemoryStatus
TerminateProcess
DeleteCriticalSection
TerminateJobObject
WriteConsoleA
EnumResourceTypesA
GetModuleFileNameA
GetBinaryTypeA
OutputDebugStringA
LoadLibraryExW
GetModuleHandleA
ReleaseMutex
SetConsoleOutputCP
LeaveCriticalSection
IsProcessInJob
SetStdHandle
FlushFileBuffers
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
VirtualFree
HeapDestroy
HeapCreate
HeapReAlloc
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
TlsAlloc
TlsGetValue
SetFilePointer
RtlUnwind
GetCurrentThread
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
SetLastError
ReadFile
MultiByteToWideChar
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
ExitProcess
FatalAppExitA
GetCurrentThreadId

shell32

SHGetSpecialFolderLocation
SHGetFolderPathAndSubDirW
SHSetLocalizedName
ShellExecuteExW
SHCreateDirectoryExW

setupapi

SetupDiOpenDeviceInterfaceRegKey
SetupDiEnumDeviceInfo
SetupScanFileQueueW
SetupDiDestroyDeviceInfoList

rpcrt4

RpcImpersonateClient
UuidFromStringW
I_RpcNsInterfaceUnexported

ole32

OleMetafilePictFromIconAndLabel
HICON_UserUnmarshal
STGMEDIUM_UserFree

rasapi32

RasGetAutodialParamW

gdi32

CloseMetaFile
SetBkMode
MaskBlt
Rectangle
ArcTo
GetGraphicsMode
GetBkMode
PlayMetaFileRecord

netapi32

NetGroupAdd
NetUserAdd
NetShareAdd

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hvwba
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PACK
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca9fa8a48bbf195cc8f0cf3646b443ff

Headers

DLL Characteristics

File Characteristics

Imports

user32

wintrust

ws2_32

urlmon

winmm

winspool.drv

iphlpapi

advapi32

oleaut32

comdlg32

kernel32

shell32

setupapi

rpcrt4

ole32

rasapi32

gdi32

netapi32

Sections

.text Size: 104KB - Virtual size: 101KB

hvwba Size: 16KB - Virtual size: 14KB

.data Size: 36KB - Virtual size: 40KB

PACK Size: 2.0MB - Virtual size: 2.0MB

.qdata Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 104KB - Virtual size: 101KB

hvwba
Size: 16KB - Virtual size: 14KB

.data
Size: 36KB - Virtual size: 40KB

PACK
Size: 2.0MB - Virtual size: 2.0MB

.qdata
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB