501dfd81e143ef9c4ffad1b8e1700dd1

Sharing

Copy URL Twitter E-mail

General

Target

501dfd81e143ef9c4ffad1b8e1700dd1
Size

385KB
MD5

501dfd81e143ef9c4ffad1b8e1700dd1
SHA1

5c0fa729d5aa2dbbfa878b381f5132c6a8f4d0e0
SHA256

6ee8fe7594fcf63e0b026dd6a3a9a7e4f79a019c8386bc82bb6cb5b1a4329829
SHA512

a32f8a047f9e4638403ad4b523b5ad30106f1b2cd75f587d23f62d5f0cb42c0d00d304d4d10200aa7036ded43acd6552b5d8c10c83bbc17e48df5a01a8711729
SSDEEP

6144:zfA/mwfWoxNS8qcRwqIjn4DfTYwn61er+PHa8:zMB9xI8qKwqID4DfUFHa8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
501dfd81e143ef9c4ffad1b8e1700dd1

Files

501dfd81e143ef9c4ffad1b8e1700dd1
.dll regsvr32 windows:4 windows x86 arch:x86

b8d07bd0344d3f59696db52824565268

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imagehlp

ImageDirectoryEntryToData
ImageUnload
ImageLoad

ws2_32

WSAStartup
WSCEnumProtocols
WSCDeinstallProvider
WSCGetProviderPath
WSACleanup

kernel32

GetEnvironmentVariableA
lstrcmpiA
GetVersion
CloseHandle
FreeLibrary
IsDBCSLeadByte
lstrcpynA
LoadLibraryExA
GetModuleHandleA
WaitForSingleObject
TerminateThread
CreateMutexA
GetWindowsDirectoryA
GetTempPathA
GetTempFileNameA
DeleteFileA
GetPrivateProfileStringA
CreateEventA
SetEvent
ResetEvent
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
WriteProcessMemory
VirtualProtect
SetLastError
FindResourceW
FindResourceExW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ReadFile
FindFirstFileA
FindNextFileA
FindClose
ExpandEnvironmentStringsA
GetSystemDirectoryA
DeviceIoControl
CreateFileA
FindResourceExA
LoadResource
GetVersionExA
InterlockedExchange
GetACP
LockResource
SizeofResource
FindResourceA
GetCurrentProcess
Sleep
GetTickCount
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
lstrcatA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
LocalFree
lstrcpyA
GetModuleFileNameA
GetLastError
GetLocaleInfoA
GetThreadLocale
lstrlenA
MultiByteToWideChar
lstrlenW

user32

LookupIconIdFromDirectoryEx
LoadImageW
LoadImageA
LoadCursorW
LoadCursorA
LoadIconW
CharNextA
PostThreadMessageA
GetMessageA
LoadIconA
LoadBitmapW
LoadBitmapA
LoadStringW
LoadStringA
CopyImage
TranslateMessage
CreateIconFromResourceEx
ReleaseDC
GetDC
GetDesktopWindow
DispatchMessageA
SetWindowTextA

gdi32

DeleteObject
CreateDIBitmap

advapi32

RegEnumKeyA
DeleteService
OpenSCManagerA
CloseServiceHandle
CreateServiceA
StartServiceA
QueryServiceStatus
CryptReleaseContext
CryptAcquireContextA
CryptHashData
CryptGetHashParam
CryptCreateHash
OpenServiceA
ControlService
QueryServiceConfigA
EnumServicesStatusA
RegCreateKeyA
RegEnumValueA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
CryptDestroyHash
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

ole32

StringFromCLSID
CoInitialize
CLSIDFromString
CoRegisterClassObject
CoInitializeEx
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
StringFromGUID2
CoCreateInstance
OleRun

oleaut32

SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy
VariantInit
VarUI4FromStr
LoadRegTypeLi
SysStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString

shlwapi

PathRemoveArgsA
PathFileExistsA
SHCreateStreamOnFileA
PathUnquoteSpacesA
PathCombineA
PathFindExtensionA
PathRenameExtensionA
SHDeleteKeyA
PathStripPathA

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Nomemory@std@@YAXXZ

msvcr71

__CppXcptFilter
__security_error_handler
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_callnewh
atoi
_mbscspn
_mbsspn
_mbslwr
_mbsstr
__RTDynamicCast
_beginthreadex
realloc
wcscpy
_purecall
_mbschr
_adjust_fdiv
_mbsinc
wcsncpy
vsprintf
_vscprintf
??_V@YAXPAX@Z
free
malloc
_resetstkoflw
memset
_ismbcspace
vswprintf
_vscwprintf
_mbsrchr
wcslen
_CxxThrowException
_except_handler3
__CxxFrameHandler
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_initterm
_onexit
_mbscmp
_mbsicmp
??0exception@@QAE@ABV0@@Z
_mbsupr
memmove
??3@YAXPAX@Z

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

ASCreateAgents
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 533B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8d07bd0344d3f59696db52824565268

Headers

File Characteristics

Imports

imagehlp

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp71

msvcr71

version

Exports

Exports

Sections

.text Size: 290KB - Virtual size: 290KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 6KB - Virtual size: 6KB

.tls Size: 1024B - Virtual size: 533B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 290KB - Virtual size: 290KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 6KB - Virtual size: 6KB

.tls
Size: 1024B - Virtual size: 533B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 29KB - Virtual size: 29KB