3467f775f7ab2c9327a30445577bfb90ace75968ab10a375b1e3b5583ad67553

Sharing

Copy URL Twitter E-mail

General

Target

3467f775f7ab2c9327a30445577bfb90ace75968ab10a375b1e3b5583ad67553
Size

3.3MB
MD5

cac4c48a404340b6d81b7bdbaa916e1b
SHA1

22b891bb422fb388783ea63c40ddca1319ebf932
SHA256

3467f775f7ab2c9327a30445577bfb90ace75968ab10a375b1e3b5583ad67553
SHA512

9fc57aee32d791250d31397a2737e1124881045a6801bffc6ec6fe7ba68f230b3ae6fd3f4d60e0ca10c388ea6ed6c7621977088528ff1e085dcfc5cb437f30af
SSDEEP

49152:Y8VfSPapA4JLEiXXEUY+Yzsmhjct4CP8p/vMORMlRTzgF4RNv4Vefo5td2PIkKQR:OapRJLBbCsejub8SRP1j4VJtd2PIkKY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3467f775f7ab2c9327a30445577bfb90ace75968ab10a375b1e3b5583ad67553

Files

3467f775f7ab2c9327a30445577bfb90ace75968ab10a375b1e3b5583ad67553
.dll windows:5 windows x86 arch:x86

d18219add4490f7ed1d30a946ea20f32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
accept
listen
ioctlsocket
gethostname
shutdown
htonl
WSACleanup
getservbyname
gethostbyname
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
WSAStartup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
getsockopt

wldap32

ord79
ord22
ord211
ord143
ord50
ord26
ord30
ord200
ord32
ord35
ord45
ord46
ord41
ord27
ord301
ord33

kernel32

GetFileType
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
GetLocalTime
CreateFileA
FreeLibrary
WaitForSingleObject
GetSystemDirectoryW
GetLocaleInfoW
GetSystemWow64DirectoryW
GetVersionExW
GetFileAttributesW
GetTempPathW
GetModuleFileNameA
GetUserDefaultUILanguage
FindFirstFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
lstrcmpA
LocalAlloc
FileTimeToLocalFileTime
LocalFree
lstrcpyW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
SleepEx
GetCurrentThreadId
GetModuleHandleA
GetVersion
GetStdHandle
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FlushConsoleInputBuffer
WideCharToMultiByte
MulDiv
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateTimerQueue
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
GetTimeZoneInformation
SetFilePointerEx
GetFileInformationByHandle
LoadLibraryExW
SetConsoleCtrlHandler
AreFileApisANSI
GetModuleHandleExW
GetCPInfo
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
ResumeThread
ExitThread
GetFileAttributesExW
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
GetStringTypeW
GetCurrentThread
GetSystemTimeAsFileTime
lstrlenA
lstrcpynW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
ReadFile
GetFileSize
CreateFileW
GetACP
MultiByteToWideChar
LockResource
WriteFile
SizeofResource
FreeResource
LoadResource
SystemTimeToFileTime
SetFilePointer
SetThreadPriority
DosDateTimeToFileTime
SetEndOfFile
GetFullPathNameW
SetEnvironmentVariableA
WriteConsoleW
GetDriveTypeW
FindFirstFileExW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindResourceW
GetTickCount
GetModuleHandleW
GetProcAddress
GetCurrentDirectoryW
GetModuleFileNameW
LoadLibraryW
CreateThread
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
GetLogicalDriveStringsW
CreateDirectoryW
ExitProcess
WinExec
TerminateProcess
OpenProcess
GetCurrentProcess
Sleep
DecodePointer
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
FlushFileBuffers
RegisterWaitForSingleObject
UnregisterWait
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
HeapSize
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
IsValidCodePage
GetOEMCP
GetConsoleCP
SwitchToThread

user32

FindWindowW
SetWindowPos
SetTimer
KillTimer
GetMessageW
DispatchMessageW
TranslateMessage
ShowWindow
SendMessageW
wsprintfW
EnableWindow
GetKeyState
DestroyWindow
ReleaseDC
CreateAcceleratorTableW
InvalidateRgn
CharPrevW
SetRect
DrawTextW
FillRect
GetWindowRgn
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
MapWindowPoints
GetCaretPos
GetDC
GetClientRect
GetWindowLongW
GetCaretBlinkTime
SetCaretPos
CreateCaret
GetFocus
IntersectRect
GetWindow
SetFocus
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
IsIconic
UnionRect
GetWindowRect
UpdateLayeredWindow
InvalidateRect
CreateWindowExW
ScreenToClient
GetCursorPos
IsWindow
SetCapture
ReleaseCapture
PostMessageW
PtInRect
GetParent
MoveWindow
IsZoomed
GetMonitorInfoW
MonitorFromWindow
SetWindowRgn
MessageBoxW
DefWindowProcW
LoadImageW
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
LoadCursorW
GetSysColor
ClientToScreen
HideCaret
ShowCaret
CharNextW
SetCursor
InflateRect
MessageBoxA
SetWindowLongW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
TrackMouseEvent
SetPropW
GetPropW
AdjustWindowRectEx
GetMenu
OffsetRect
RegisterClassW

gdi32

GetClipBox
SelectClipRgn
PtInRegion
CreateRectRgn
CreateSolidBrush
SetTextColor
SetBkMode
GetDeviceCaps
CreateRoundRectRgn
GetTextMetricsW
BitBlt
CreateCompatibleBitmap
RestoreDC
SaveDC
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
CreatePen
CreateFontIndirectW
GetStockObject
GetObjectW
CreateRectRgnIndirect
ExtSelectClipRgn
CombineRgn
SetStretchBltMode
CreatePenIndirect
LineTo
Rectangle
RoundRect
GetObjectA
SetBkColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
StretchBlt
MoveToEx

advapi32

RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCreateKeyExW
RegSetValueExW
ConvertSidToStringSidW
RegDeleteValueW
RegOpenKeyExA
LookupAccountNameW
RegDeleteKeyW
RegQueryValueExA
RegCreateKeyW
RevertToSelf
ImpersonateLoggedOnUser
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegOpenKeyA
DeregisterEventSource
ReportEventA
RegisterEventSourceA

shell32

SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteExW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
PropVariantClear
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CLSIDFromProgID
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

gdiplus

GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth
GdipGetImageHeight
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipCreateSolidFill
GdipImageGetFrameDimensionsCount
GdipCloneBrush
GdipFillRectangleI
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipMeasureString
GdipDrawString
GdiplusShutdown
GdipDeleteBrush
GdiplusStartup

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

comctl32

_TrackMouseEvent
ord17

shlwapi

PathFileExistsW
SHStrDupW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

userenv

GetUserProfileDirectoryW
LoadUserProfileW
UnloadUserProfile

crypt32

CryptMsgClose
CryptDecodeObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptQueryObject

Exports

Exports

AddMenuAction
AddSubMenuAction
CheckSignStats
CheckUninstallFlash
ControlBindNSISScript
CurrentUserIsLocalSystem
DeleteFCShortCut
DeleteHKCUReg
DeleteMenuAction
ExitNsDui
FCAesEncryptString
FindControl
GetApplicationLocale
GetCheckBoxStatus
GetCurrentUserPath
GetFlashCenterInstallPath
GetFlashInstallPath
GetInstallDir
GetMacValue
GetOSVersion
GetTimeStamp
GetUUIDAndMacAndCPU
IEOpenUrl
InitReg
InitWnd
InstallSvc
IsChineseSimpleLang
PinTaskbar_1809
ResetDefaultApp
SelectInstallDir
SetCheckBoxStatus
SetDefaultApp
SetDefaultOpenProg
SetInstallDir
SetInstallSpaceInfo
SetProgressValue
SetVersion
ShowMainWnd
UninstallHS
UnstallGames
UpdateShortcutLink
WriteHKCUReg
WriteSettingXml
compareVersion
nsDuiSendMessage
startProgress
stopProgress

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d18219add4490f7ed1d30a946ea20f32

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

imm32

comctl32

shlwapi

version

wininet

iphlpapi

userenv

crypt32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 402KB - Virtual size: 402KB

.data Size: 52KB - Virtual size: 80KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 85KB - Virtual size: 84KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 402KB - Virtual size: 402KB

.data
Size: 52KB - Virtual size: 80KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 85KB - Virtual size: 84KB

.rmnet
Size: 56KB - Virtual size: 60KB