8c9e43fb4f663af7641316264cec0e54

Sharing

Copy URL Twitter E-mail

General

Target

8c9e43fb4f663af7641316264cec0e54
Size

530KB
MD5

8c9e43fb4f663af7641316264cec0e54
SHA1

013c41293861aba8436f52e544dcc18c06412e61
SHA256

74d028442fd41cfe7e8aa29e7261f3594f99817b82ad693b2ccc6beb8ff08e21
SHA512

104f4264dfa3ebea96bfe9acb7ed6acf7590af1d4b2b93ded700a92e3e13afcd69fdfaf434088b687c8d331ce6a4ac127ca5c038125834ddc645c2ada4ecd2d3
SSDEEP

12288:/pXxzoN5KwBQmqWPFIDmS+avG46ZLOjgQgv:pFofKwBpRMo46ZLOjAv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c9e43fb4f663af7641316264cec0e54

Files

8c9e43fb4f663af7641316264cec0e54
.dll windows:6 windows x64 arch:x64

38744f74c20defab3068315295c21a96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCPInfo
GetACP
IsValidCodePage
WideCharToMultiByte
MultiByteToWideChar
UnregisterWait
RegisterWaitForSingleObject
CopyFileA
LoadLibraryW
OpenFileMappingA
CreateFileMappingA
lstrlenW
SetCommBreak
ClearCommBreak
LocalFree
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFileEx
MapViewOfFile
CreateFileMappingW
IsDBCSLeadByteEx
GetTickCount
CreateThread
Sleep
OpenMutexW
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetOverlappedResult
GetProcessHeaps
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetComputerNameExW
GetLastError
CloseHandle
ReadFile
GetFileSize
GetDiskFreeSpaceExW
GetStdHandle
CreateFileW
GetSystemTimeAsFileTime
InitializeSListHead

gdi32

CreateFontIndirectExW
GetObjectType
DeleteObject
DeleteDC
CreateFontA
CreateFontIndirectA
LineDDA
SetRectRgn
CreateDCW

advapi32

OpenSCManagerA
MakeSelfRelativeSD
CloseEventLog
OpenEventLogW
AccessCheckAndAuditAlarmA
ObjectDeleteAuditAlarmA
CloseServiceHandle
CreateServiceW
GetTrusteeTypeW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CredDeleteW
CredWriteDomainCredentialsW
ConvertStringSidToSidA
ConvertSidToStringSidW
ControlTraceA
QueryServiceStatusEx
OpenServiceW
OpenServiceA
OpenSCManagerW
DeleteService
GetServiceKeyNameW
MakeAbsoluteSD

shell32

ord2
ord4
DragFinish
SHGetUnreadMailCountW
SHGetFolderPathAndSubDirW
SHGetFolderPathAndSubDirA
ord18
ord231
ord155
SHGetFolderPathA
DragQueryPoint

shlwapi

StrTrimA
StrChrA
StrCSpnIW
SHQueryValueExW
PathFileExistsA
PathIsNetworkPathW
PathStripPathW
UrlGetLocationA
SHDeleteKeyA
PathAddExtensionW
StrCmpIW
SHAutoComplete
ord172
SHRegCloseUSKey
SHRegQueryInfoUSKeyA
SHRegOpenUSKeyA
PathSkipRootA

dbghelp

SymGetSearchPath
SymInitialize
SymCleanup
SymGetOptions
SymSetOptions
GetTimestampForLoadedLibrary
ImagehlpApiVersionEx
ImagehlpApiVersion
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
SymRegisterFunctionEntryCallback64

imm32

ImmRegisterWordA
ImmGetCandidateListCountA
ImmGetConversionListW
ImmGetCandidateListW
ImmIsIME
ImmGetStatusWindowPos
ImmUnregisterWordA
ImmGetIMEFileNameA

winmm

mmioDescend
mmioAscend
midiOutGetNumDevs
mmioGetInfo
midiInGetErrorTextW
mciGetDeviceIDW
midiInGetID
mmioClose
midiOutGetDevCapsW
mciGetCreatorTask
mmioOpenA
joyGetDevCapsA

rpcrt4

MesEncodeIncrementalHandleCreate
MesEncodeFixedBufferHandleCreate
MesBufferHandleReset
MesHandleFree
MesIncrementalHandleReset
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
I_RpcMapWin32Status
MesDecodeIncrementalHandleCreate

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memset
memmove
memcpy
memcmp
memchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_cexit
exit
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

wcsncpy
_stricmp
_strnicmp
strncpy
strncmp
wcsncat
strncat
_wcsnicmp
isspace
isxdigit

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_callnewh
calloc
free

api-ms-win-crt-convert-l1-1-0

_itoa
_ltow
_itow
strtoul
atoi
_ultoa
_ultow

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-stdio-l1-1-0

setbuf
ftell
fseek
fread
fopen
fflush
ferror
fclose
__acrt_iob_func
__stdio_common_vfprintf
fwrite

Exports

Exports

bkr_destroy
dump_buffer_hex
extract_binaries
plog
progress_thread

Sections

.text
Size: 460KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38744f74c20defab3068315295c21a96

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

shlwapi

dbghelp

imm32

winmm

rpcrt4

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

Exports

Exports

Sections

.text Size: 460KB - Virtual size: 459KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 19KB - Virtual size: 20KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 980B

.text
Size: 460KB - Virtual size: 459KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 19KB - Virtual size: 20KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 980B