8f68a5ea9cae9bb1435b54dd7c93a337

Sharing

Copy URL Twitter E-mail

General

Target

8f68a5ea9cae9bb1435b54dd7c93a337
Size

1.7MB
MD5

8f68a5ea9cae9bb1435b54dd7c93a337
SHA1

41c02fbd77c110e401337055bfb5bfcb65d35b6b
SHA256

a60fd0ba484d81bfd28aad68bf6bba1080e1020e255fe40069fe720ff1053b61
SHA512

0e71099d3ba2201b6b39d38c5ba0c9b8fc893061cc118498e2bdb24caa6ccb680d72f69717fdad0937add6cb43b18d975ca54c15984ae267e559ab5d1ae3fe62
SSDEEP

12288:krx5N2yCzu7Ich8QA4xHAVgi8HD+j98WA/JInC8UaK7He4FcQk1qbaTtcML:a8yCzuUch8QvgmQ1axTv7He4it19CM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f68a5ea9cae9bb1435b54dd7c93a337

Files

8f68a5ea9cae9bb1435b54dd7c93a337
.dll windows:5 windows

160803213b59d442b460b99c67c62347

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GetCommandLineA
GetCommandLineW
MoveFileExW
GetVersionExW
GetShortPathNameW
GetLongPathNameW
WriteFile
FindClose
DuplicateHandle
SystemTimeToFileTime
ExpandEnvironmentStringsW
GetTempPathW
GetCurrentDirectoryW
CreateDirectoryW
GetFullPathNameW
CreateFileW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
LocalAlloc
HeapAlloc
HeapFree
GetProcessHeap
OpenProcess
GetCurrentProcessId
GetLocalTime
FileTimeToSystemTime
LoadLibraryA
GetSystemDirectoryW
GetWindowsDirectoryW
GetVolumeInformationW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetCurrentThread
VirtualFree
VirtualAlloc
LocalFree
SetThreadPriority
PostQueuedCompletionStatus
SetErrorMode
GetQueuedCompletionStatus
CreateIoCompletionPort
FreeLibrary
FormatMessageA
DebugBreak
SetLastError
MultiByteToWideChar
SetFilePointerEx
WideCharToMultiByte
FlushFileBuffers
ReadDirectoryChangesW
GetConsoleMode
GetFileType
RegisterWaitForSingleObject
UnregisterWait
QueueUserWorkItem
CreateEventW
CreateMutexA
TlsSetValue
EnterCriticalSection
ReleaseSemaphore
InterlockedCompareExchange
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
ResumeThread
SetEvent
TlsAlloc
ResetEvent
CreateSemaphoreW
TlsGetValue
TlsFree
SetHandleInformation
SetConsoleCtrlHandler
CancelIo
SetEnvironmentVariableW
QueryPerformanceFrequency
GetSystemInfo
QueryPerformanceCounter
GetThreadTimes
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
WriteConsoleW
HeapSize
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
HeapReAlloc
GetModuleFileNameA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
GetConsoleCP
SetStdHandle
VirtualQuery
InterlockedFlushSList
LoadLibraryExW
RtlUnwind
OutputDebugStringW
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
InitializeSListHead
UnmapViewOfFile
MapViewOfFile
GetNativeSystemInfo
GetExitCodeThread
CreateThread
TerminateProcess
ExitProcess
GetCurrentProcess
GetProcAddress
CreateEventA
WaitForSingleObject
InterlockedExchange
GetTickCount
Sleep
MoveFileW
CopyFileW
GetEnvironmentVariableW
CreateProcessW
GetModuleFileNameW
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
WaitForSingleObjectEx

shell32

SHGetFolderPathW
SHGetFolderPathA

ole32

CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoCreateGuid

ws2_32

WSARecv
WSAIoctl
ioctlsocket
WSASend
GetAddrInfoW
getsockopt
setsockopt
WSAGetLastError
WSARecvFrom
shutdown
sendto
send
select
recvfrom
recv
ntohs
ntohl
listen
inet_addr
htons
htonl
getpeername
connect
closesocket
bind
accept
WSAStartup
WSASetLastError
socket
FreeAddrInfoW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

user32

GetLastInputInfo
GetDesktopWindow
GetWindowRect

advapi32

LsaAddAccountRights
LsaClose
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidW
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserW
GetUserNameW
LookupPrivilegeValueW
InitializeSecurityDescriptor
GetSidSubAuthority
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

oleaut32

VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

DllInstall

Sections

.text
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

160803213b59d442b460b99c67c62347

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

ole32

ws2_32

userenv

user32

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 479KB - Virtual size: 479KB

.rdata Size: 113KB - Virtual size: 112KB

.data Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 479KB - Virtual size: 479KB

.rdata
Size: 113KB - Virtual size: 112KB

.data
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 21KB - Virtual size: 21KB