cb4b05aa5fed25fe93f7438c6616358fdfa576374cc2ac5be0152f5ebe160dcc

Sharing

Copy URL Twitter E-mail

General

Target

cb4b05aa5fed25fe93f7438c6616358fdfa576374cc2ac5be0152f5ebe160dcc
Size

1.5MB
MD5

a900b1c12892bd0946a2f072462f50e1
SHA1

ba6cdd37f2381a004feb4c197f161ba34ffe572e
SHA256

cb4b05aa5fed25fe93f7438c6616358fdfa576374cc2ac5be0152f5ebe160dcc
SHA512

ef693dcc6da747f696ed8b9badb905ea0d577ef0b48320e736bdd0dc839a378fa3e93d8fc73ddf2743552aa4c32b7908bbf037e090056e7dd0df2ed3421dab01
SSDEEP

24576:FB7mNB9Wit8GtN7U9pZ3W38uSx6dhGlo1TSPAKzqvKj4Lt:f4Pt8GtNYrdxnlo1T+Dzog4Lt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb4b05aa5fed25fe93f7438c6616358fdfa576374cc2ac5be0152f5ebe160dcc

Files

cb4b05aa5fed25fe93f7438c6616358fdfa576374cc2ac5be0152f5ebe160dcc
.dll windows:6 windows x86 arch:x86

b04ec30e2991e9c630b5da3589855bca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\lopdf\nsis_scripts\xpfeditor\setupdll\Release\setupdll.pdb

Imports

kernel32

LoadLibraryA
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleW
GetVersionExA
GetLocalTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
GetTickCount
WriteConsoleW
SetEndOfFile
HeapSize
FlushFileBuffers
CreateFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
MulDiv
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeZoneInformation
SetStdHandle
GetFileSizeEx
GetConsoleCP
WriteFile
SetFilePointerEx
ReadConsoleW
GetConsoleMode
HeapReAlloc
GetFileType
GetStdHandle
GetModuleHandleExW
ReadFile
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RaiseException
RtlUnwind
CreateThread
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalLock
GlobalUnlock
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
LocalFree
GetStringTypeW
FindResourceW
SizeofResource
LockResource
LoadResource
FreeResource
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
Sleep
FlushInstructionCache
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
GetLastError
lstrcpyW
SetDllDirectoryW
SetCurrentDirectoryW
lstrcpynW
MultiByteToWideChar
lstrcpynA
GlobalFree
lstrcpyA
GlobalAlloc
WideCharToMultiByte
CloseHandle
InitializeSListHead
GetVolumeInformationW
OutputDebugStringA
ExitProcess
lstrlenA

user32

GetActiveWindow
ShowWindow
CallWindowProcW
SetWindowLongW
IsIconic
GetCursorPos
FindWindowExW
PostMessageW
DestroyWindow
MessageBoxW
DestroyCursor
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
SetWindowPos
GetDlgItem
GetClientRect
GetWindowRect
MapWindowPoints
GetWindowLongW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
PostQuitMessage
AnimateWindow
DrawIconEx
InvertRect
FillRect
SetLayeredWindowAttributes
IsZoomed
SendMessageW
LoadCursorW
IsWindow
SetFocus
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
UpdateWindow
GetDC
ReleaseDC
GetForegroundWindow
MsgWaitForMultipleObjects
UpdateLayeredWindow
MapVirtualKeyA
CharLowerBuffW
GetDesktopWindow
SetActiveWindow
EnableWindow
SystemParametersInfoA
DrawTextW
IsWindowVisible
GetSystemMetrics
EnableMenuItem
ClientToScreen
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetIconInfo
CharNextW
LoadImageW
CreateIconFromResource
LoadBitmapW
GetKeyState
GetFocus
LoadIconW
OffsetRect
GetSysColor
SetMenuContextHelpId
SetForegroundWindow
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
AppendMenuW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
IsWindowEnabled
IsMenu
PtInRect
EqualRect
SetRect
SetCursor
DestroyIcon
GetClassNameW
IsRectEmpty
UnionRect
IntersectRect
InflateRect
CopyRect
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
CreateCaret
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint

gdi32

PtInRegion
RectInRegion
RestoreDC
SetViewportOrgEx
CreateCompatibleBitmap
StretchBlt
GetObjectW
SetBkMode
Rectangle
GetStockObject
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
SelectObject
DeleteDC
CreateCompatibleDC
CreateBitmap
CreateRoundRectRgn
EnumFontsW
DeleteObject
BitBlt
RoundRect
Arc
CombineRgn
CreateEllipticRgnIndirect
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
Ellipse
ExcludeClipRect
GetClipRgn
GetRgnBox
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
GetViewportOrgEx
GetCurrentObject
Polyline
ExtCreatePen
CreateDIBSection
SetWorldTransform
GetWorldTransform
SetTextColor
SetROP2
SetRectRgn
ExtSelectClipRgn
SaveDC
Pie

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

OleUninitialize
CoTaskMemFree
CreateStreamOnHGlobal
IIDFromString
CreateBindCtx
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleInitialize

oleaut32

SysAllocString
SysFreeString

shlwapi

StrToIntExW

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

wininet

HttpQueryInfoA
HttpOpenRequestA
InternetOpenW
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetReadFile

iphlpapi

GetAdaptersInfo

gdiplus

GdipAlloc
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree

msimg32

AlphaBlend
GradientFill

Exports

Exports

BindControlAndNSISScript
BindingProgress
ClosePage
FindChildByName
FindStringByName
GetControlProperties
GetUdid
InitWindow
NSISMessageBox
NSISOpenFolderDialog
NSISScriptSendMessage
SetControlProperties
ShowPage

Sections

.text
Size: 791KB - Virtual size: 791KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 393KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b04ec30e2991e9c630b5da3589855bca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

imm32

wininet

iphlpapi

gdiplus

msimg32

Exports

Exports

Sections

.text Size: 791KB - Virtual size: 791KB

.rdata Size: 244KB - Virtual size: 244KB

.data Size: 27KB - Virtual size: 95KB

.rsrc Size: 393KB - Virtual size: 392KB

.reloc Size: 60KB - Virtual size: 60KB

.text
Size: 791KB - Virtual size: 791KB

.rdata
Size: 244KB - Virtual size: 244KB

.data
Size: 27KB - Virtual size: 95KB

.rsrc
Size: 393KB - Virtual size: 392KB

.reloc
Size: 60KB - Virtual size: 60KB