5547298738ba296551265e9c46b62a20

Sharing

Copy URL Twitter E-mail

General

Target

5547298738ba296551265e9c46b62a20
Size

360KB
MD5

5547298738ba296551265e9c46b62a20
SHA1

e1927e0b073aa2e4535b6d92bddf5de70632933f
SHA256

a10fdc3e879a8bcfbae8957eb015e761028b8186f2b7e9ca979632fd0b5e5780
SHA512

fe895441168674460e3cfc72db89a41d6422042bf38021ed8e3bfdfe22e5c8657fbec410b612a17df530d2fe0ba210aaeff5c61f6e8f59fdf64243143ffcc107
SSDEEP

6144:xi4mcAFCQP1Do/B7STCFOSpcud0V1V24jceDCijVZT+qDbSGYsC2MOWxDUff0mi:04vAFCQ9Do57STEOe+7jceWixZiIbSGI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5547298738ba296551265e9c46b62a20

Files

5547298738ba296551265e9c46b62a20
.dll windows:4 windows x86 arch:x86

1b9c21ca1adb60ce0fdc677f6eb0e5be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohl
getsockopt
connect
gethostbyname
inet_ntoa
ntohs
recv
send
getsockname
getpeername
WSAGetLastError
htons

kernel32

FreeLibraryAndExitThread
CreateProcessA
CreateMutexA
WaitForSingleObject
CloseHandle
WaitForMultipleObjects
OpenProcess
OpenEventA
GetTickCount
SetEvent
CreateEventA
DisableThreadLibraryCalls
QueryPerformanceCounter
GlobalUnlock
GlobalLock
GlobalAlloc
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
GlobalFree
VirtualAlloc
VirtualQuery
InterlockedCompareExchange
ResumeThread
VirtualProtect
FlushInstructionCache
GetCurrentProcess
GetThreadContext
SetThreadContext
SuspendThread
FreeLibrary
GetModuleHandleA
GetCommandLineA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersion
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
SetLastError
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
lstrlenA
lstrlenW
WideCharToMultiByte
GetLastError
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
FlushFileBuffers
Sleep
QueryPerformanceFrequency
SetStdHandle
GetLocaleInfoW
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ResetEvent
ReleaseMutex
CreateSemaphoreA
ReleaseSemaphore
LocalAlloc
LocalFree
LoadLibraryExA
FormatMessageA
HeapAlloc
GetSystemInfo
WriteFile
HeapFree
RtlUnwind
ExitThread
CreateThread
GetSystemTimeAsFileTime
ExitProcess
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
SetUnhandledExceptionFilter
HeapSize
GetOEMCP
UnhandledExceptionFilter
SetHandleCount

user32

GetClassNameA
GetWindowTextA
FindWindowExA
GetAncestor
LoadStringA
GetParent
CallNextHookEx
IsWindowVisible
GetWindow
GetMessageA
DispatchMessageA
GetForegroundWindow
GetWindowThreadProcessId
SendMessageA
GetTopWindow
PostThreadMessageA

advapi32

CreateProcessAsUserA
OpenProcessToken
GetTokenInformation
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
EqualSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
SetSecurityInfo
RegDeleteKeyA
RegEnumKeyExA

ole32

CoInitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface

oleaut32

VariantInit
VariantClear
VariantChangeType
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
DispGetParam

rpcrt4

UuidCompare
UuidCreate

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

?Mine_PR_Close@@YA?AW4PRStatus@@PAUPRFileDesc@@@Z
?Mine_PR_Read@@YAHPAUPRFileDesc@@PAXH@Z
?Mine_PR_Write@@YAHPAUPRFileDesc@@PBXH@Z
CheckCapability
ConfigBrowsers
ConfigLSP
GetServiceProviderInfo
IsCSLOAConfigured
IsLSPConfigured
KeyboardHookProc
MouseHookProc
MsgHookProc
Register
SetAutoRestartProc
SetForegroundURL
ShellHookProc
StartShellEvent
UnconfigBrowsers
UnconfigLSP
UnlockShellEvent
UpdateTopURL

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b9c21ca1adb60ce0fdc677f6eb0e5be

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

version

Exports

Exports

Sections

.text Size: 256KB - Virtual size: 252KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 8KB - Virtual size: 21KB

Shared Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 256KB - Virtual size: 252KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 8KB - Virtual size: 21KB

Shared
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 21KB