767b661339f842a24584de1cfd7ff58a

Sharing

Copy URL Twitter E-mail

General

Target

767b661339f842a24584de1cfd7ff58a
Size

2.0MB
MD5

767b661339f842a24584de1cfd7ff58a
SHA1

e01e2af3f556dab1835683abc02c7e6f4886568e
SHA256

12f891dd73ef13029a6cb2422c35d390835c149c627ec7f52a985633b4ec14d4
SHA512

ac3f08cd8a55c437a73d79529ff0e3133a7c30d666dc11ef200a5096435ffa15a6c3030f41b1de623e7cb080508d2e89b25539230e886abbd6c2c7ed58861b9c
SSDEEP

12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
767b661339f842a24584de1cfd7ff58a

Files

767b661339f842a24584de1cfd7ff58a
.dll windows:5 windows x64 arch:x64

6668be91e2c948b183827f040944057f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

LookupIconIdFromDirectoryEx
WaitForInputIdle
GetParent
GetFocus

setupapi

CM_Get_Resource_Conflict_DetailsW

kernel32

DeleteCriticalSection
DeleteTimerQueue
TerminateJobObject
GetFileInformationByHandle
GetThreadLocale
GetNamedPipeServerProcessId
GetConsoleFontSize

gdi32

CreateBitmapIndirect
GetPolyFillMode

crypt32

CertGetCTLContextProperty

advapi32

AddAccessDeniedObjectAce

shlwapi

ChrCmpIW

Exports

Exports

CloseThreadWaitChainSession
GetThreadWaitChain
OpenThreadWaitChainSession
RegisterWaitChainCOMCallback
WerAddExcludedApplication
WerFreeString
WerRemoveExcludedApplication
WerReportAddDump
WerReportAddFile
WerReportCloseHandle
WerReportCreate
WerReportSetParameter
WerReportSetUIOption
WerReportSubmit
WerStoreClose
WerStoreGetFirstReportKey
WerStoreGetNextReportKey
WerStoreGetReportCount
WerStoreGetSizeOnDisk
WerStoreOpen
WerStorePurge
WerStoreQueryReportMetadataV1
WerStoreQueryReportMetadataV2
WerStoreQueryReportMetadataV3
WerStoreUploadReport
WerSysprepCleanup
WerSysprepGeneralize
WerUnattendedSetup
WerpAddAppCompatData
WerpAddFile
WerpAddFileBuffer
WerpAddFileCallback
WerpAddIfRegisteredForAppLocalDump
WerpAddMemoryBlock
WerpAddRegisteredDataToReport
WerpAddRegisteredDumpsToReport
WerpAddRegisteredMetadataToReport
WerpAddTerminationReason
WerpArchiveReport
WerpAuxmdDumpProcessImages
WerpAuxmdDumpRegisteredBlocks
WerpAuxmdFree
WerpAuxmdFreeCopyBuffer
WerpAuxmdHashVaRanges
WerpAuxmdInitialize
WerpAuxmdMapFile
WerpCancelUpload
WerpCleanWer
WerpCloseStore
WerpCreateIntegratorReportId
WerpCreateMachineStore
WerpDeleteReport
WerpDestroyWerString
WerpEnumerateStoreNext
WerpEnumerateStoreStart
WerpExtractReportFiles
WerpFlushImageCache
WerpForceDeferredCollection
WerpFreeString
WerpFreeUnmappedVaRanges
WerpGetAADTenantInfo
WerpGetBucketId
WerpGetDynamicParameter
WerpGetEventType
WerpGetExtendedDiagData
WerpGetFileByIndex
WerpGetFilePathByIndex
WerpGetIntegratorReportId
WerpGetLegacyBucketId
WerpGetLoadedModuleByIndex
WerpGetNumFiles
WerpGetNumLoadedModules
WerpGetNumSigParams
WerpGetPathOfWERTempDirectory
WerpGetReportConsent
WerpGetReportCount
WerpGetReportFinalConsent
WerpGetReportFlags
WerpGetReportId
WerpGetReportInformation
WerpGetReportSettings
WerpGetReportTime
WerpGetReportType
WerpGetResponseId
WerpGetSigParamByIndex
WerpGetStoreLocation
WerpGetStorePath
WerpGetStoreType
WerpGetTextFromReport
WerpGetUIParamByIndex
WerpGetUploadTime
WerpGetWerStringData
WerpGetWow64Process
WerpHashApplicationParameters
WerpInitializeImageCache
WerpIsDisabled
WerpIsOnBattery
WerpIsTransportAvailable
WerpLoadReport
WerpLoadReportFromBuffer
WerpOpenMachineArchive
WerpOpenMachineQueue
WerpPromptUser
WerpPruneStore
WerpReportCancel
WerpReportSprintfParameter
WerpReserveMachineQueueReportDir
WerpResetTransientImageCacheStatistics
WerpRestartApplication
WerpSetAADTenantInfo
WerpSetAuxiliaryArchivePath
WerpSetCallBack
WerpSetDefaultUserConsent
WerpSetDynamicParameter
WerpSetEventName
WerpSetExitListeners
WerpSetIntegratorReportId
WerpSetIptEnabled
WerpSetProcessTimelines
WerpSetQuickDumpType
WerpSetReportApplicationIdentity
WerpSetReportFlags
WerpSetReportInformation
WerpSetReportIsFatal
WerpSetReportNamespaceParameter
WerpSetReportOption
WerpSetReportTime
WerpSetReportUploadContextToken
WerpSetTelemetryAppParams
WerpSetTelemetryKernelParams
WerpSetTelemetryServiceParams
WerpSetTtdStatus
WerpShowUpsellUI
WerpStitchedMinidumpVmPostReadCallback
WerpStitchedMinidumpVmPreReadCallback
WerpStitchedMinidumpVmQueryCallback
WerpSubmitReportFromStore
WerpTraceAuxMemDumpStatistics
WerpTraceDuration
WerpTraceImageCacheStatistics
WerpTraceSnapshotStatistics
WerpTraceStitchedDumpWriterStatistics
WerpTraceUnmappedVaRangesStatistics
WerpUnmapProcessViews
WerpValidateReportKey
WerpWalkGatherBlocks

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.qkm
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cvjb
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tlmkv
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wucsxe
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fltwtj
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sfplio
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rpg
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bewzc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vksvaw
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wmhg
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kswemc
Size: 4KB - Virtual size: 877B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kaxfk
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wualk
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qdxz
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hsfs
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kihf
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gwiv
Size: 4KB - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rhy
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.meo
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xmlw
Size: 4KB - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fxs
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ubyib
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tylhq
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mgdkwn
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wqf
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vnayiv
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eiycnq
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yyk
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pxgzl
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yshrqu
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wuzb
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qwrug
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ssjzyu
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6668be91e2c948b183827f040944057f

Headers

DLL Characteristics

File Characteristics

Imports

user32

setupapi

kernel32

gdi32

crypt32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 260KB - Virtual size: 257KB

.rdata Size: 404KB - Virtual size: 403KB

.data Size: 96KB - Virtual size: 94KB

.pdata Size: 4KB - Virtual size: 300B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 8KB

.qkm Size: 4KB - Virtual size: 1KB

.cvjb Size: 8KB - Virtual size: 7KB

.tlmkv Size: 4KB - Virtual size: 2KB

.wucsxe Size: 280KB - Virtual size: 276KB

.fltwtj Size: 8KB - Virtual size: 4KB

.sfplio Size: 4KB - Virtual size: 1KB

.rpg Size: 280KB - Virtual size: 276KB

.bewzc Size: 8KB - Virtual size: 4KB

.vksvaw Size: 4KB - Virtual size: 1KB

.wmhg Size: 8KB - Virtual size: 4KB

.kswemc Size: 4KB - Virtual size: 877B

.kaxfk Size: 8KB - Virtual size: 6KB

.wualk Size: 4KB - Virtual size: 2KB

.qdxz Size: 4KB - Virtual size: 2KB

.hsfs Size: 4KB - Virtual size: 503B

.kihf Size: 280KB - Virtual size: 276KB

.gwiv Size: 4KB - Virtual size: 954B

.rhy Size: 8KB - Virtual size: 7KB

.meo Size: 8KB - Virtual size: 4KB

.xmlw Size: 4KB - Virtual size: 318B

.fxs Size: 8KB - Virtual size: 5KB

.ubyib Size: 4KB - Virtual size: 1KB

.tylhq Size: 8KB - Virtual size: 5KB

.mgdkwn Size: 4KB - Virtual size: 2KB

.wqf Size: 4KB - Virtual size: 1KB

.vnayiv Size: 4KB - Virtual size: 2KB

.eiycnq Size: 4KB - Virtual size: 1KB

.yyk Size: 4KB - Virtual size: 503B

.pxgzl Size: 4KB - Virtual size: 1KB

.yshrqu Size: 4KB - Virtual size: 1KB

.wuzb Size: 280KB - Virtual size: 276KB

.qwrug Size: 4KB - Virtual size: 1KB

.ssjzyu Size: 8KB - Virtual size: 4KB

.text
Size: 260KB - Virtual size: 257KB

.rdata
Size: 404KB - Virtual size: 403KB

.data
Size: 96KB - Virtual size: 94KB

.pdata
Size: 4KB - Virtual size: 300B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 8KB

.qkm
Size: 4KB - Virtual size: 1KB

.cvjb
Size: 8KB - Virtual size: 7KB

.tlmkv
Size: 4KB - Virtual size: 2KB

.wucsxe
Size: 280KB - Virtual size: 276KB

.fltwtj
Size: 8KB - Virtual size: 4KB

.sfplio
Size: 4KB - Virtual size: 1KB

.rpg
Size: 280KB - Virtual size: 276KB

.bewzc
Size: 8KB - Virtual size: 4KB

.vksvaw
Size: 4KB - Virtual size: 1KB

.wmhg
Size: 8KB - Virtual size: 4KB

.kswemc
Size: 4KB - Virtual size: 877B

.kaxfk
Size: 8KB - Virtual size: 6KB

.wualk
Size: 4KB - Virtual size: 2KB

.qdxz
Size: 4KB - Virtual size: 2KB

.hsfs
Size: 4KB - Virtual size: 503B

.kihf
Size: 280KB - Virtual size: 276KB

.gwiv
Size: 4KB - Virtual size: 954B

.rhy
Size: 8KB - Virtual size: 7KB

.meo
Size: 8KB - Virtual size: 4KB

.xmlw
Size: 4KB - Virtual size: 318B

.fxs
Size: 8KB - Virtual size: 5KB

.ubyib
Size: 4KB - Virtual size: 1KB

.tylhq
Size: 8KB - Virtual size: 5KB

.mgdkwn
Size: 4KB - Virtual size: 2KB

.wqf
Size: 4KB - Virtual size: 1KB

.vnayiv
Size: 4KB - Virtual size: 2KB

.eiycnq
Size: 4KB - Virtual size: 1KB

.yyk
Size: 4KB - Virtual size: 503B

.pxgzl
Size: 4KB - Virtual size: 1KB

.yshrqu
Size: 4KB - Virtual size: 1KB

.wuzb
Size: 280KB - Virtual size: 276KB

.qwrug
Size: 4KB - Virtual size: 1KB

.ssjzyu
Size: 8KB - Virtual size: 4KB