a7fe8df5895fde2e439449a706e9f55c3f8e86b8a5ddcd5ebd2e7386abcb82c4

Sharing

Copy URL Twitter E-mail

General

Target

a7fe8df5895fde2e439449a706e9f55c3f8e86b8a5ddcd5ebd2e7386abcb82c4
Size

3.9MB
MD5

cabf0deb869fa78a4c61e9050a3c0010
SHA1

591c571cb9e444827f5d3deffdf7dafd3bc33498
SHA256

a7fe8df5895fde2e439449a706e9f55c3f8e86b8a5ddcd5ebd2e7386abcb82c4
SHA512

892cc5b3070cb97ae5e48ccabb795e24e145ff73a06f43c4ea043baa581ae87df5e1f3ad154f1be99ae15944b607b41b6cb42414e8a0860cb5d3c64dd7cac0a5
SSDEEP

98304:EXFXB5Ut7jgZFlaqJ9O7YRbL2ESKD3T0:+XB5U2mKw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7fe8df5895fde2e439449a706e9f55c3f8e86b8a5ddcd5ebd2e7386abcb82c4

Files

a7fe8df5895fde2e439449a706e9f55c3f8e86b8a5ddcd5ebd2e7386abcb82c4
.dll windows:6 windows x86 arch:x86

90dbb07a34efcb5706d29ac5ca083492

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

gethostname
inet_pton
send
recvfrom
recv
sendto
select
__WSAFDIsSet
WSARecv
listen
WSASocketW
shutdown
setsockopt
ioctlsocket
getsockopt
getpeername
WSASend
WSASetLastError
WSAAddressToStringW
WSAGetLastError
ntohl
WSAStartup
WSACleanup
ntohs
htons
htonl
closesocket
bind

kernel32

FindClose
FindFirstFileA
FindNextFileA
GetTempPathA
Sleep
VirtualQuery
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
FileTimeToSystemTime
GetWindowsDirectoryA
GetVersionExA
GetModuleHandleA
GetTimeZoneInformation
CreateFileW
GetFileSize
SetFilePointer
SetLastError
CreateProcessA
ProcessIdToSessionId
LoadLibraryA
lstrcmpiW
lstrcpyA
lstrcatA
GetLogicalDriveStringsA
QueryDosDeviceA
WTSGetActiveConsoleSessionId
MultiByteToWideChar
WideCharToMultiByte
Process32FirstW
Process32NextW
HeapFree
HeapAlloc
GetProcessHeap
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
GetEnvironmentVariableA
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FormatMessageA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsSetValue
TlsGetValue
SleepEx
SetEvent
CreateEventW
CreateIoCompletionPort
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
VerSetConditionMask
QueueUserAPC
TerminateThread
WaitForMultipleObjects
TlsFree
TlsAlloc
CreateWaitableTimerA
RaiseException
InitializeCriticalSectionEx
DecodePointer
GetCurrentThreadId
VirtualAlloc
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
InitializeCriticalSection
FreeLibrary
GetCurrentProcessId
DuplicateHandle
LocalFileTimeToFileTime
GetFileAttributesA
SystemTimeToFileTime
UnmapViewOfFile
GetFileInformationByHandle
CreateFileMappingA
MapViewOfFile
GetTickCount
lstrlenA
K32GetProcessImageFileNameA
FlushFileBuffers
OutputDebugStringW
WaitForSingleObjectEx
GlobalFree
CreateFileMappingW
GetSystemTime
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
HeapReAlloc
DeleteFileW
DeleteFileA
FlushViewOfFile
GetFileAttributesExW
GetDiskFreeSpaceA
HeapSize
HeapValidate
GetVersionExW
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
InterlockedCompareExchange
GetFullPathNameW
HeapCreate
AreFileApisANSI
LoadLibraryExA
VirtualFree
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
GetCPInfo
GetStringTypeW
GetModuleHandleExW
QueueUserWorkItem
IsProcessorFeaturePresent
TryEnterCriticalSection
EncodePointer
GetNativeSystemInfo
GetCurrentThread
SwitchToThread
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameA
lstrcmpiA
ReadProcessMemory
VirtualQueryEx
VirtualProtectEx
GetSystemInfo
OpenProcess
WaitForSingleObject
WriteFile
ReadFile
GetFileSizeEx
CreateFileA
QueryPerformanceCounter
LocalFree
LoadResource
QueryPerformanceFrequency
LockResource
GetLastError
RegisterWaitForSingleObject
GetModuleHandleExA
LocalAlloc
CreateMutexA
FindResourceA
TerminateProcess
OutputDebugStringA
GetCurrentProcess
SizeofResource
CreateThread
CloseHandle
DisableThreadLibraryCalls
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetStdHandle
GetFileType
WriteConsoleW
CreateTimerQueueTimer
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetEnvironmentVariableW
MoveFileExW
SetFilePointerEx
ExitThread
ExitProcess
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW
SetStdHandle
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetCurrentDirectoryA
GetProcessAffinityMask
SetThreadAffinityMask
FormatMessageW

user32

DefWindowProcA
GetClassInfoExA
GetDesktopWindow
RegisterClassExA
FindWindowExA
GetClassNameA
IsWindow
SetParent
GetParent
GetWindow
SetFocus
IsWindowVisible
ShowWindow
UpdateWindow
LoadCursorA
GetWindowRect
SetWindowPos
CallWindowProcA
BeginPaint
EndPaint
RegisterWindowMessageW
RegisterShellHookWindow
GetForegroundWindow
GetWindowThreadProcessId
GetMessageA
DispatchMessageA
CloseWindow
GetDC
ReleaseDC
GetAsyncKeyState
GetClientRect
SetCursor
UpdateLayeredWindow
GetCursorPos
GetClassInfoA
SetWindowsHookExA
UnhookWindowsHookEx
MoveWindow
GetWindowTextA
PostMessageA
SendMessageA
TranslateMessage
DestroyWindow
wsprintfW
CreateWindowExA
GetWindowLongA
PtInRect
SetWindowLongA
SetForegroundWindow
UnregisterClassA

gdi32

GetPixel
CreateCompatibleDC
CreateDCA
GetObjectA
CreateDIBSection
SelectObject
GetDIBits
DeleteObject
DeleteDC

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
CreateProcessAsUserW
OpenProcessToken
SetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupAccountSidA
ConvertSidToStringSidA
LookupAccountNameA
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA

shell32

SHAppBarMessage
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHCreateDirectoryExA
SHGetPathFromIDListA

ole32

OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoTaskMemFree
CoUninitialize
CoInitializeSecurity

bcrypt

BCryptGetProperty
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey

winhttp

WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpQueryOption
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetCredentials
WinHttpReceiveResponse
WinHttpQueryHeaders

psapi

GetProcessImageFileNameA

iphlpapi

GetAdaptersInfo

shlwapi

PathRemoveFileSpecA
PathRemoveFileSpecW
PathFileExistsA
PathStripPathA
PathCombineA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

crypt32

CertGetNameStringA

mswsock

AcceptEx
GetAcceptExSockaddrs

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFileICM
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM

comctl32

_TrackMouseEvent

wintrust

CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

Exports

Exports

CmdLineCb
Start
sqlite3_csv_init
sqlite3_shathree_init

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90dbb07a34efcb5706d29ac5ca083492

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

bcrypt

winhttp

psapi

iphlpapi

shlwapi

userenv

crypt32

mswsock

gdiplus

comctl32

wintrust

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 400KB - Virtual size: 399KB

.data Size: 55KB - Virtual size: 80KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 80KB - Virtual size: 80KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 400KB - Virtual size: 399KB

.data
Size: 55KB - Virtual size: 80KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 80KB - Virtual size: 80KB