54f338407f2318b65c300917fc57cbe3

Sharing

Copy URL Twitter E-mail

General

Target

54f338407f2318b65c300917fc57cbe3
Size

124KB
MD5

54f338407f2318b65c300917fc57cbe3
SHA1

d91634486b757366df5b3eba3f3a46d8d8386fec
SHA256

7bfaeacf454619aac311d61fada1149a1a159870fc279b20f57c173ae2c31e38
SHA512

4375b89436a03bc71991aa40f3c87e312b1d35275beb4a11a816dccdf98a3bd789e1f058eb2362e654dfc2395e0dabbd894674aea937763dfb2c019ce2f55387
SSDEEP

3072:1pTIt9oZWvGEM0WU3++c1hx0VmVpgyGS++M1t1D23a/5:bTIvGEnNMv1pgA+51t1AK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54f338407f2318b65c300917fc57cbe3

Files

54f338407f2318b65c300917fc57cbe3
.dll windows:4 windows x86 arch:x86

238cb5f2deaa053b751e1585a2284b01

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr71

_strcmpi
_strnicmp
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
_beginthreadex
strtok
wcstombs
atoi
strncat
strncpy
??0exception@@QAE@ABV0@@Z
strrchr
_except_handler3
free
??0exception@@QAE@XZ
??1exception@@UAE@XZ
realloc
malloc
strchr
_CxxThrowException
memmove
strstr
ceil
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z

kernel32

FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
SetFilePointer
MoveFileA
ReadFile
HeapFree
HeapAlloc
GetProcessHeap
LockResource
LoadResource
CancelIo
FindResourceA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
OpenProcess
GetLocalTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DisconnectNamedPipe
TerminateProcess
GetVolumeInformationA
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GetComputerNameA
GlobalMemoryStatus
GetLastError
GetModuleFileNameA
GetTempPathA
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
DisableThreadLibraryCalls
InitializeCriticalSection
ExitProcess
lstrcmpiA
CopyFileA
ReleaseMutex
GetCommandLineA
InterlockedExchange
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
lstrcpyA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
GetDiskFreeSpaceExA
GetFileAttributesA
PeekNamedPipe
CreateDirectoryA
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
DeleteCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
CreateEventA
GetSystemDirectoryA
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
ResetEvent
GetSystemInfo
Sleep
SizeofResource
SetFileAttributesA

user32

TranslateMessage
GetMessageA
wsprintfA
CharNextA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
CallNextHookEx
UnhookWindowsHookEx
LoadCursorA
DestroyCursor
keybd_event
MapVirtualKeyA
SetCapture
DispatchMessageA
ReleaseDC
CreateWindowExA
CloseWindow
PostMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
IsWindow
GetCursorPos
SetRect
GetDesktopWindow
GetDC
OpenDesktopA
GetCursorInfo
SystemParametersInfoA
SendMessageA
BlockInput
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint

gdi32

SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
CreateDIBSection
BitBlt
DeleteObject
DeleteDC

advapi32

AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
RegQueryValueExA
GetTokenInformation
LookupAccountSidA
RegisterServiceCtrlHandlerA
StartServiceA
OpenSCManagerA
CreateServiceA
GetFileSecurityA
GetSecurityDescriptorDacl
GetAclInformation
EqualSid
GetAce
SetFileSecurityA
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
InitializeSecurityDescriptor

shell32

SHGetFileInfoA

winmm

waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveInAddBuffer
waveInStop
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveInStart
waveOutUnprepareHeader
waveOutWrite
waveOutClose

ws2_32

recv
send
WSAIoctl
connect
htons
closesocket
gethostbyname
WSAStartup
socket
gethostname
getsockname
select

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameStart
ICOpen
ICSeqCompressFrame
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetSetOptionA
InternetCloseHandle

netapi32

NetUserGetLocalGroups
NetApiBufferFree

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Exports

Exports

IEHelpSetup
ServiceMain
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificati
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

238cb5f2deaa053b751e1585a2284b01

Headers

File Characteristics

Imports

msvcr71

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

msvcp71

imm32

avicap32

msvfw32

wininet

netapi32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 78KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 960B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 80KB - Virtual size: 78KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 960B

.reloc
Size: 8KB - Virtual size: 7KB