9973550609fe85f04d7241430b865e51

Sharing

Copy URL Twitter E-mail

General

Target

9973550609fe85f04d7241430b865e51
Size

135KB
MD5

9973550609fe85f04d7241430b865e51
SHA1

2a0a271be6aa5e10028ff739eaba09d8955ee120
SHA256

b2c1225e81c12a75528cdb53e69c628708a0ff76c3d0f54b8d147a4d256ea391
SHA512

41036f840fb378b9cbb370e5a939e17ced4d2c8513d5f6934cec50d3bc56a5390db8407de36c672be2df53d770f4646dc527482d2ae4c41b74fc39bcee08fd3b
SSDEEP

3072:cn9xB3+MiJKAAsM1mWRpqnHBv6HgEz3TO:2LqnAsM1Jwh2gEzjO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9973550609fe85f04d7241430b865e51

Files

9973550609fe85f04d7241430b865e51
.dll windows:5 windows x86 arch:x86

34e2e349efbc270078d12006faf3c6d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

sprintf
_snprintf
strrchr
_vsnprintf
swprintf
_ftol
wcscmp
wcsstr
wcscat
wcsrchr
memmove
realloc
wcscpy
wcslen
free
??2@YAPAXI@Z
??3@YAXPAX@Z

advapi32

FreeSid
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegQueryValueExA
RegCloseKey

gdi32

DeleteObject
GetDIBits
GetObjectW

kernel32

FormatMessageA
GetCurrentThreadId
DebugBreak
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
lstrcpyA
OutputDebugStringW
lstrcpyW
CompareStringW
LocalFree
LocalAlloc
CreateDirectoryW
GetFileAttributesW
GetLastError
GetSystemDirectoryW
FileTimeToSystemTime
FileTimeToLocalFileTime
CloseHandle
Sleep
ReadFile
CreateFileW
DeleteFileW
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetLocalTime
HeapFree
WriteFile
ReleaseMutex
SetFilePointerEx
CreateMutexA
HeapAlloc
GetProcessHeap
lstrcatA
GetModuleFileNameA
lstrcpynA
OutputDebugStringA
WaitForSingleObject
ExpandEnvironmentStringsA
CreateFileA
FlushFileBuffers

user32

wsprintfW
GetDC
LoadImageW
LoadStringW

oleaut32

SysAllocString
SysFreeString

ole32

CoCreateInstance
CLSIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

wiaservc

wiasWritePropStr
wiasReadPropGuid
wiasWriteMultiple
wiasFreePropContext
wiasGetItemType
wiasFormatArgs
wiasUpdateValidFormat
wiasCreatePropContext
wiasValidateItemProperties
wiasCreateDrvItem
wiasWritePropLong
wiasSetItemPropAttribs
wiasSetItemPropNames
wiasWriteBufToFile
wiasGetDrvItem
wiasQueueEvent

gdiplus

GdipLoadImageFromStream
GdiplusShutdown
GdipCloneImage
GdipLoadImageFromStreamICM
GdipAlloc
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipSaveImageToStream
GdipGetImageType
GdipGetImageDimension
GdipGetImagePixelFormat
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipFree
GdipDisposeImage
GdiplusStartup
GdipGetImageThumbnail

Exports

Exports

DllCanUnloadNow
DllGetClassObject
_DllEntryPoint@12

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34e2e349efbc270078d12006faf3c6d3

Headers

File Characteristics

Imports

msvcrt

advapi32

gdi32

kernel32

user32

oleaut32

ole32

wiaservc

gdiplus

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.data Size: 512B - Virtual size: 764B

.shared Size: 56KB - Virtual size: 56KB

.rsrc Size: 28KB - Virtual size: 28KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 46KB - Virtual size: 46KB

.data
Size: 512B - Virtual size: 764B

.shared
Size: 56KB - Virtual size: 56KB

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 2KB - Virtual size: 2KB