c998b46056de84f7ff2a8eb7679b67b1bf5d87c18324f84f6b8916be31b98b2a

Sharing

Copy URL Twitter E-mail

General

Target

c998b46056de84f7ff2a8eb7679b67b1bf5d87c18324f84f6b8916be31b98b2a
Size

1.1MB
MD5

2a663062da7c18ed76ab1fe754b51fab
SHA1

535f2ff89dbad763b50d5783c6bfde745e36cf4e
SHA256

c998b46056de84f7ff2a8eb7679b67b1bf5d87c18324f84f6b8916be31b98b2a
SHA512

1dec0c587cbb595a0b11fcf731b7893f42d791e0aaffe977717e6f45e5954a39080099ec3da9c733036ef3ae53f5feb56569ad779091af876f6787edc85608fb
SSDEEP

12288:e3/Mql3YMkV26VeQcNPBS6Bbz3lzWTIc7/bfYtvDHMO/k/ztpSplsbiJBWJbnS/:O/MqxRCDVl6BnFWP7r/a+biJBQnS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c998b46056de84f7ff2a8eb7679b67b1bf5d87c18324f84f6b8916be31b98b2a

Files

c998b46056de84f7ff2a8eb7679b67b1bf5d87c18324f84f6b8916be31b98b2a
.dll windows:6 windows x86 arch:x86

af1e05d44edef5be5069326b16a42550

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
HeapDestroy
HeapSize
HeapFree
GetProcessHeap

api-ms-win-core-synch-l1-1-0

ResetEvent
ReleaseSemaphore
InitializeCriticalSectionEx
TryEnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
SetEvent

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
GetFileAttributesW
ReadFile
SetFileAttributesW
SetFilePointerEx
FindFirstFileExW
FindFirstFileW
SetEndOfFile
FindNextFileW
GetFileSizeEx
GetDiskFreeSpaceExW
GetFileType
CreateDirectoryW
WriteFile
DeleteFileW
FlushFileBuffers
FindClose

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
IsValidCodePage
GetACP
GetCPInfo

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetLogicalProcessorInformation
GetVersionExW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
ExitProcess
SwitchToThread
TlsGetValue
GetThreadPriority
SetThreadPriority
CreateThread
GetCurrentProcess
GetCurrentThread

api-ms-win-core-com-l1-1-0

CoUninitialize
CoIncrementMTAUsage
CreateStreamOnHGlobal
CoTaskMemFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
FreeLibrary
FreeLibraryAndExitThread

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait
Sleep

oleaut32

SysFreeString

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
FlushInstructionCache
OpenProcess
IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualQuery

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-file-l2-1-0

MoveFileExW

kernel32

GetModuleHandleW
FindResourceW
LoadResource
LCMapStringW
UnhandledExceptionFilter
CreateToolhelp32Snapshot
GetStartupInfoW
VirtualAlloc
LoadLibraryExA
WinExec
lstrcpynW
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
FindResourceExW
LoadLibraryW
LockResource
RegisterWaitForSingleObject
UnregisterWait
GetModuleHandleA
LoadLibraryExW
VirtualProtect
UnregisterWaitEx
CreateTimerQueue
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetOEMCP
Process32NextW
Process32FirstW
lstrlenW
lstrcpyW
GetPrivateProfileStringW
MoveFileW
GetShortPathNameW
GetSystemDefaultUILanguage
GetModuleHandleExW
SizeofResource
CreateFileW
VerifyVersionInfoW
VerSetConditionMask

user32

GetParent
SetWindowLongW
LoadCursorW
MoveWindow
IsWindow
ShowWindow
SetWindowTextW
GetSystemMetrics
SendMessageW
CreateWindowExW
GetWindowRect
PostMessageW
CallWindowProcW
DefWindowProcW
GetWindowLongW
EndPaint
BeginPaint
InvalidateRect
DrawTextW
GetClientRect
wsprintfW
RedrawWindow
SetWindowPos
DestroyWindow
IsWindowEnabled
ReleaseCapture
PtInRect
SetCapture
ClientToScreen
GetCapture
InflateRect
GetDlgItem
LoadImageW
PostQuitMessage
IsWindowVisible
GetMonitorInfoW
MonitorFromWindow
GetWindow
FindWindowW
TranslateMessage
DispatchMessageW
UnregisterClassW
CreateDialogParamW
GetMessageW
GetDlgCtrlID
MapWindowPoints

gdi32

CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
MoveToEx
ExtTextOutW
SetTextCharacterExtra
SelectObject
LineTo
DeleteDC
GetTextExtentExPointW
GetObjectW
StretchBlt
SetDIBColorTable
GetDIBColorTable
SetTextColor
CreateDIBSection
GetTextExtentPoint32W
TextOutW
SetBkMode
CreateFontIndirectW
CreatePen
Rectangle
SetBkColor
DeleteObject

advapi32

RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
RegSetKeyValueW
RegGetValueW
ControlService
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
CloseServiceHandle
OpenSCManagerW
DeleteService
OpenServiceW

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoCreateInstance
CoInitialize

shlwapi

PathRemoveFileSpecW
PathAppendW
PathFileExistsW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend
TransparentBlt

gdiplus

GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCreateBitmapFromStreamICM
GdipGetImageWidth
GdipAlloc
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipDrawImageI
GdiplusStartup
GdipDisposeImage

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetEnvironmentStringsW
SetStdHandle
FreeEnvironmentStringsW
GetStdHandle
GetCommandLineA

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleMode
GetConsoleCP
WriteConsoleW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo

Exports

Exports

AtMostVersion
BackupFile
CheckHybrid
DeleteAppIconLink
DeleteOfficeDriveAppLink
DeleteUpgraderFile
ForceKillProcess
GetInstallWindow
GetWindowVersion
RemoveDriver
RemovePendingDelFile
SendStatisticInfo
ShowWarningWindow
StopProgress
UnRegisterHybrid
closeProgressDlg

Sections

.text
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 419KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af1e05d44edef5be5069326b16a42550

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

oleaut32

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-file-l2-1-0

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

msimg32

gdiplus

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

Exports

Exports

Sections

.text Size: 471KB - Virtual size: 471KB

.rdata Size: 419KB - Virtual size: 419KB

.data Size: 11KB - Virtual size: 17KB

.rsrc Size: 164KB - Virtual size: 163KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 471KB - Virtual size: 471KB

.rdata
Size: 419KB - Virtual size: 419KB

.data
Size: 11KB - Virtual size: 17KB

.rsrc
Size: 164KB - Virtual size: 163KB

.reloc
Size: 22KB - Virtual size: 22KB