964ef61029988db27a4152c768bf418d

Sharing

Copy URL Twitter E-mail

General

Target

964ef61029988db27a4152c768bf418d
Size

218KB
MD5

964ef61029988db27a4152c768bf418d
SHA1

27ab2b7e60e59180a5a8eab8fcfe943aa8d4187d
SHA256

5c45313407cc69bcb86be55630704e5f17038c6c91b9d3ff72c4d25978049b60
SHA512

cbfcd2620ec8e8a910846cb72ac3fea72017afb48742e78d7b9bb31414ef4795f14bd994963aa6d8ad342a802dd89b94951c5b9788324cb8004e6174655e863f
SSDEEP

3072:IpZiuPrsKd/IKWF+Po0fxoQWVNiRwdUbj6WCFWDz3OqS9ZymM7x7uE+AQgOGK42V:sZjPrxhIKZ7xoQWD4wdDK3kyz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
964ef61029988db27a4152c768bf418d

Files

964ef61029988db27a4152c768bf418d
.dll windows:4 windows x86 arch:x86

550d8eaa6b803e91bb445d7a2cb77686

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imm32

ImmIsIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetOpenStatus
ImmNotifyIME
ImmGetContext
ImmReleaseContext
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmSetCompositionFontW
ImmSetCompositionFontA

comctl32

ord17

kernel32

HeapSize
HeapReAlloc
VirtualAlloc
GetOEMCP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
Sleep
ExitProcess
InterlockedDecrement
GetLastError
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcessHeap
HeapAlloc
HeapFree
GetCommandLineA
GetCurrentThreadId
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetErrorMode
GlobalFlags
lstrcpynA
GetSystemTime
lstrcmpA
GetTickCount
lstrcatA
lstrcpyA
IsBadReadPtr
IsBadHugeWritePtr
FindResourceW
LoadResource
LockResource
GetVersion
SetEndOfFile
WriteFile
SetFilePointer
IsBadHugeReadPtr
ReadFile
GlobalReAlloc
GlobalSize
LocalReAlloc
FreeLibrary
GetProcAddress
DeleteAtom
IsBadWritePtr
MulDiv
LocalLock
LocalUnlock
IsDBCSLeadByte
GetModuleFileNameW
GetModuleFileNameA
GetAtomNameW
GetAtomNameA
AddAtomW
AddAtomA
LoadLibraryW
LoadLibraryA
GetProfileStringW
GetProfileStringA
GetProfileIntW
GetProfileIntA
IsDBCSLeadByteEx
LocalAlloc
GetLocaleInfoA
IsValidCodePage
GetACP
GetVersionExA
GetCPInfo
GetStringTypeW
GetStringTypeA
LocalFree
lstrlenW
WideCharToMultiByte
GlobalLock
lstrlenA
GlobalAlloc
MultiByteToWideChar
GlobalUnlock
GlobalFree
FreeEnvironmentStringsA

gdi32

GetMapMode
CreateCompatibleBitmap
SetBkMode
SetPixel
SelectClipRgn
OffsetRgn
GetTextMetricsW
TranslateCharsetInfo
CreateDCA
CreateDCW
CreateICA
CreateICW
CreateFontIndirectA
CreateFontIndirectW
CreateEnhMetaFileA
CreateEnhMetaFileW
ExtTextOutA
GetTextCharset
ExtTextOutW
EnumFontFamiliesExA
EnumFontFamiliesExW
GetTextFaceA
GetTextFaceW
GetObjectType
GetObjectA
GetObjectW
LPtoDP
DPtoLP
ExcludeClipRect
GetDeviceCaps
SaveDC
SetWindowOrgEx
SetMapMode
SetViewportOrgEx
DeleteObject
GetStockObject
SelectObject
CreateSolidBrush
RestoreDC
SetViewportExtEx
SetWindowExtEx
EnumFontFamiliesW
SetBkColor
SetTextColor
GetTextExtentPoint32A
GetTextExtentPoint32W
LineTo
MoveToEx
CreatePen
CreatePatternBrush
CreateBitmap
CreateDIBitmap
DeleteDC
BitBlt
CreateCompatibleDC
PolyPolyline
Rectangle
GetCharWidthW
SetBrushOrgEx
UnrealizeObject
SetTextAlign
PatBlt
GetClipBox
GetCharWidth32W
GetWindowExtEx
GetViewportExtEx
GdiComment
GetWindowOrgEx
GetViewportOrgEx
CloseEnhMetaFile
IntersectClipRect
GetTextMetricsA

winspool.drv

DeviceCapabilitiesW

comdlg32

ChooseColorA
ChooseColorW
ChooseFontA
ReplaceTextW
ReplaceTextA
FindTextW
FindTextA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoCreateInstance
CoInitialize
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize

oleaut32

SysAllocStringLen
SysFreeString
VariantInit
SysAllocString

Exports

Exports

CreateTextControl
CreateTextControlW
DebugTXFormat
FM_EnumFunc
GetErrorCode
ListCharDlg
ListParaDlg
ObjAttrTab1Dlg
ObjAttrTab2Dlg
ObjAttrTab3Dlg
ObjAttrTab4Dlg
PageDataCallBack
ParagraphTab1Dlg
ParagraphTab2Dlg
SectTab1Dlg
SectTab2Dlg
SelectFontDlg
SetDefaultDialogFont
TXGetErrorCode
TXGetVersion
TXInitialize
TXRegisterClass
TX_KBHookFunc
TX_WndProc
TabbedDlg
TblAttrTab1Dlg
TblAttrTab2Dlg
_EnumFontFamExProcU@16
_TD_Proc@16
_WndProcU@16

Sections

.text
Size: 89KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1024B - Virtual size: 789B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

550d8eaa6b803e91bb445d7a2cb77686

Headers

File Characteristics

Imports

imm32

comctl32

kernel32

gdi32

winspool.drv

comdlg32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 160KB

.bss Size: - Virtual size: 192KB

.pdata Size: 4KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 4KB

.edata Size: 1024B - Virtual size: 789B

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 106KB - Virtual size: 105KB

.reloc Size: 4KB - Virtual size: 244B

.text
Size: 89KB - Virtual size: 160KB

.bss
Size: - Virtual size: 192KB

.pdata
Size: 4KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 4KB

.edata
Size: 1024B - Virtual size: 789B

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 106KB - Virtual size: 105KB

.reloc
Size: 4KB - Virtual size: 244B