4493c4092b8c5d3a6a214c5416723c743f8c489c8fa93a75bbc6e360fce1d5cb

Sharing

Copy URL Twitter E-mail

General

Target

4493c4092b8c5d3a6a214c5416723c743f8c489c8fa93a75bbc6e360fce1d5cb
Size

2.8MB
MD5

f7eded26e264d42dbbcc3f9a71e790b0
SHA1

12299d3b584816409946606be5fd41bd5a95e579
SHA256

4493c4092b8c5d3a6a214c5416723c743f8c489c8fa93a75bbc6e360fce1d5cb
SHA512

3aef3b2c90a13c2498df3c2b6a45dfa0b17d4f55e6b88eceb5974408915ee7fc8173bd00b6ede8076c4abb4393df2f1e3a47a2c3c356297fd59c0e8f4aa20f42
SSDEEP

49152:FUpPGcPLx25IJ8AGiHq4bq+IV2cxkPBgzMZTSXFBthvPp/VKlD:FUpPhV+T+o2EMi/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4493c4092b8c5d3a6a214c5416723c743f8c489c8fa93a75bbc6e360fce1d5cb

Files

4493c4092b8c5d3a6a214c5416723c743f8c489c8fa93a75bbc6e360fce1d5cb
.dll regsvr32 windows:6 windows x86 arch:x86

ed16126ecedff018043cc1f925e0a753

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFileTime
GetFileType
GetFileInformationByHandle
GetFileInformationByHandleEx
FreeResource
GetSystemInfo
VirtualFree
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
GetDateFormatEx
GetTimeFormatEx
QueryPerformanceCounter
GetCurrentDirectoryW
GetUserPreferredUILanguages
GetLocaleInfoEx
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
GetFullPathNameW
OpenMutexW
GetEnvironmentVariableW
SizeofResource
LockResource
LoadResource
GetFileAttributesW
lstrcpynA
lstrcpynW
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetStdHandle
GetConsoleOutputCP
GetOEMCP
FindFirstFileExW
GetFinalPathNameByHandleW
SetFileValidData
ReplaceFileW
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
PeekNamedPipe
GetDriveTypeW
SetConsoleCtrlHandler
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
GetProcAddress
LoadLibraryA
GetModuleHandleA
CopyFileW
SetEndOfFile
SetFilePointer
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
ReadFile
SetLastError
LocalFree
GetCurrentThreadId
GetLastError
DeleteFileW
MoveFileExW
CreateDirectoryW
GetCurrentProcessId
FreeLibrary
LoadLibraryW
GetModuleFileNameW
VerifyVersionInfoW
VerSetConditionMask
WriteFile
SetNamedPipeHandleState
CreateFileW
Sleep
CloseHandle
SetFileInformationByHandle
FindClose
CancelIo
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
FindResourceW
FindNextFileW
FindFirstFileW
RemoveDirectoryW
SetFileAttributesW
HeapSize
CreateProcessW
GetModuleHandleExW
InitializeCriticalSectionEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleHandleW
GetSystemTimeAsFileTime
GetACP
GetSystemDirectoryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TryAcquireSRWLockExclusive
GetStringTypeW
WakeAllConditionVariable
SleepConditionVariableSRW

user32

GetProcessWindowStation
DestroyIcon
GetUserObjectInformationW
MessageBoxW
LoadImageW
GetSystemMetrics
InsertMenuW
SetMenuInfo
SetMenuItemInfoW
CreateIconIndirect
ReleaseDC
GetDC
GetIconInfo

gdi32

DeleteDC
PatBlt
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteObject
CreateBitmap

ws2_32

select
gethostbyname
htons
getsockopt
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
ntohs
htonl
inet_ntop
ntohl
shutdown
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getservbyname
recv
send
closesocket
connect
setsockopt
socket
ioctlsocket

shell32

SHGetStockIconInfo
SHGetFileInfoW
ord727
DragQueryFileW
DuplicateIcon
SHChangeNotify
SHGetSpecialFolderPathW

advapi32

CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptSignHashW
CryptEnumProvidersW
RegQueryValueExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
GetUserNameW
GetSecurityInfo
SetSecurityDescriptorControl
DeleteAce
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetAce
EqualSid
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW

crypt32

CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore

gdiplus

GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipDrawArcI
GdipDrawEllipseI
GdipFillEllipseI
GdipCloneBitmapAreaI
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill

shlwapi

PathFindExtensionW

mpr

WNetGetUniversalNameW

ntdll

RtlFreeHeap
RtlAllocateHeap

ncrypt

BCryptGenRandom

Exports

Exports

DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
GetExtVersion

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 549KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed16126ecedff018043cc1f925e0a753

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

shell32

advapi32

crypt32

gdiplus

shlwapi

mpr

ntdll

ncrypt

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 549KB - Virtual size: 548KB

.data Size: 17KB - Virtual size: 58KB

.rsrc Size: 376KB - Virtual size: 376KB

.reloc Size: 88KB - Virtual size: 88KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 549KB - Virtual size: 548KB

.data
Size: 17KB - Virtual size: 58KB

.rsrc
Size: 376KB - Virtual size: 376KB

.reloc
Size: 88KB - Virtual size: 88KB