6617d54893ad004d87c84bee45f51fb8

Sharing

Copy URL Twitter E-mail

General

Target

6617d54893ad004d87c84bee45f51fb8
Size

431KB
MD5

6617d54893ad004d87c84bee45f51fb8
SHA1

35496d761f59f4e0a1a4673778f37bc8230be71e
SHA256

26cff20dcfc89f27b1eb7b4a46a938967a023001280ad9441fec55498efbfa9b
SHA512

358896dac0cc8a085c38dd1f6699025d92de8876237e2bf62448aa15e9e63936823b6d6536fd9d7c13a826228c26d7fd5060d0d7f401bebba45429c702ce483a
SSDEEP

6144:hV/Gj66GsqsirHBrNQeIZP3apYb85kUOQeewQeeFQeesQee/vQeefQeebwCWVdEI:G66Gs9R3Pqqb85kObdjnShkqpYIp5K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6617d54893ad004d87c84bee45f51fb8

Files

6617d54893ad004d87c84bee45f51fb8
.dll regsvr32 windows:6 windows x86 arch:x86

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??2@YAPAXI@Z
realloc
free
malloc
memset
??_V@YAXPAX@Z
wcschr
_vsnwprintf
wcspbrk
??3@YAXPAX@Z
_CIacos
_finite
longjmp
_setjmp3
isdigit
isspace
_CIpow
floor
_vsnprintf
exit
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler
_CIatan2
_CIsqrt
rand
time
srand
_wcsicmp
_CIcos
_CIsin
??_U@YAPAXI@Z
_purecall
memcpy

ntdll

RtlUnwind

kernel32

GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DisableThreadLibraryCalls
lstrcpynW
GetModuleFileNameW
FreeLibrary
LockResource
LoadLibraryW
lstrcatW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
WaitForSingleObject
SetEvent
VirtualFree
FlushInstructionCache
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
InterlockedExchange
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
Sleep
InterlockedCompareExchange
IsProcessorFeaturePresent
GetVersionExA
FindResourceA
LocalAlloc
RaiseException
GetProcAddress

advapi32

RegOpenKeyA
RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
TraceMessage
RegQueryValueExW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VarUI4FromStr
LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysAllocStringLen

user32

IsWindow
FillRect
GetClientRect
GetDC
GetSystemMetrics
IsRectEmpty
SetRectEmpty
CopyRect
SetCursor
PostMessageW
DefWindowProcW
SetWindowLongW
ReleaseDC
CallWindowProcW
CallNextHookEx
GetAsyncKeyState
DestroyWindow
UnhookWindowsHookEx
GetSysColor
UpdateWindow
ShowWindow
SetWindowsHookExW
IsWindowUnicode
CreateWindowExW
RegisterClassW
LoadCursorW
MonitorFromWindow
GetWindowRect
CharPrevW
CharNextW
GetWindowLongW

gdi32

StretchBlt
SetBkColor
SetTextColor
TextOutW
SetStretchBltMode
DeleteObject
SetTextAlign
GetStockObject

gdiplus

GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipCreatePen2
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipSetPathGradientCenterColor
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPointI
GdipSetPathGradientFocusScales
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateLineBrushFromRectI
GdipStartPathFigure
GdipAddPathEllipseI
GdipCreatePathGradientFromPath
GdipCreateFromHDC
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipDrawLineI

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

004206ea8e4e089bdefdd0e8270b0615

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

advapi32

ole32

oleaut32

user32

gdi32

gdiplus

winmm

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 11KB - Virtual size: 11KB

.text Size: 94KB - Virtual size: 96KB

.text
Size: 285KB - Virtual size: 285KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 94KB - Virtual size: 96KB