b39670bedf295960796c845f88ef827c217826a44e014653139b36e6961dcfd6

Sharing

Copy URL

Twitter E-mail

General

Target

b39670bedf295960796c845f88ef827c217826a44e014653139b36e6961dcfd6
Size

11.4MB
MD5

a1f1d550df5b5a64f6c3c0ca934dd0ec
SHA1

2b0052b07082841a77235446b8561645fcc0529d
SHA256

b39670bedf295960796c845f88ef827c217826a44e014653139b36e6961dcfd6
SHA512

553ebc9369b1a768e471a476cd1f577844aaaa9017637cec3664f8721721f22feeff1675fe7b1c3960f6720cf9e22776c3b8813d37d6b3b852d35f93d4c4f2b6
SSDEEP

196608:HAATQYDjsjKYkIrtTMyg2R1Si4uESzMM3EnOQ3s+0A7Hx:8rti2R1bhEXcLu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b39670bedf295960796c845f88ef827c217826a44e014653139b36e6961dcfd6

Files

b39670bedf295960796c845f88ef827c217826a44e014653139b36e6961dcfd6
.dll windows:6 windows x64 arch:x64

2ed960d5e82f439fa7e9ddcaef8c5eff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrIA
PathFileExistsW
SHGetValueW
SHSetValueW
PathAddBackslashW
PathStripPathW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW

userenv

ExpandEnvironmentStringsForUserW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSQueryUserToken

kernel32

QueryDosDeviceW
GetLogicalDrives
WriteProcessMemory
GetCurrentProcess
GetProcessId
Thread32Next
Thread32First
GetSystemDirectoryW
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
CloseHandle
LoadLibraryW
Module32FirstW
GetProcAddress
VirtualAllocEx
ReadProcessMemory
GetModuleHandleW
CreateRemoteThread
Module32NextW
VirtualFreeEx
IsWow64Process
VirtualQueryEx
FindFirstFileW
GetLongPathNameW
ExpandEnvironmentStringsW
GetTempPathW
CreateFileW
GetLogicalDriveStringsW
GetWindowsDirectoryW
WTSGetActiveConsoleSessionId
ReadFile
UnmapViewOfFile
GetModuleHandleA
LoadLibraryA
GetFileSize
CopyFileW
CreateFileMappingW
MapViewOfFile
SizeofResource
GetFileSizeEx
FindNextFileW
WriteFile
EnumResourceNamesW
LockResource
LoadResource
FindResourceW
SetFilePointerEx
SystemTimeToFileTime
FindClose
GetCurrentThread
K32GetModuleFileNameExW
LocalFree
SetLastError
DeviceIoControl
WaitForMultipleObjects
WaitForSingleObject
GetVersionExW
CreateEventW
SetEvent
CreateThread
GetCurrentThreadId
GetExitCodeThread
TerminateThread
DeleteFileW
FreeLibrary
SearchPathW
MoveFileExW
GetModuleHandleExW
GetThreadTimes
OpenThread
DuplicateHandle
FileTimeToLocalFileTime
CreateMutexW
GetSystemInfo
SetProcessWorkingSetSize
OpenFileMappingW
CreateSemaphoreW
FileTimeToSystemTime
GetLocalTime
SetFilePointer
GetThreadContext
GetProcessTimes
GetExitCodeProcess
GetNativeSystemInfo
GetModuleHandleExA
GetTempFileNameA
GetTempPathA
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
DeleteFileA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
DosDateTimeToFileTime
VirtualQuery
SetThreadContext
FlushInstructionCache
HeapDestroy
SuspendThread
HeapCreate
SetEndOfFile
WriteConsoleW
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
SwitchToThread
Sleep
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
TryEnterCriticalSection
HeapReAlloc
HeapFree
HeapAlloc
SystemTimeToTzSpecificLocalTime
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
PeekNamedPipe
GetFileType
GetDriveTypeW
ResumeThread
ExitThread
GetCommandLineW
GetCommandLineA
RtlUnwindEx
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
FlushFileBuffers
ExitProcess
GetModuleFileNameA
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapSize
GetConsoleCP
ReadConsoleW
GetConsoleMode
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
IsBadReadPtr
VirtualProtect
ReleaseMutex
OpenMutexW
GetStringTypeW
WaitForSingleObjectEx
EncodePointer
DecodePointer
GetCPInfo
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
InitOnceExecuteOnce
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
LoadLibraryExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RaiseException
GetStdHandle

user32

GetDesktopWindow
DefWindowProcW
CreateWindowExW
RegisterClassW
GetMessageW
CallNextHookEx
DispatchMessageW
UnhookWindowsHookEx
TranslateMessage
SetWindowsHookExW
PostThreadMessageW
GetWindowLongPtrW
GetClassLongPtrA
GetClientRect
OemToCharBuffW
GetForegroundWindow
GetClassNameW
FindWindowExW
GetWindowThreadProcessId
LookupIconIdFromDirectory
EnumWindows
EnumChildWindows
wsprintfW
FindWindowW
SendMessageTimeoutW
IsWindowUnicode
GetWindowLongPtrA
GetClassLongPtrW
GetWindowRect
GetWindowLongW
GetWindowInfo
GetWindowTextW
IsWindowVisible
InternalGetWindowText
IsIconic

advapi32

RegEnumValueW
RevertToSelf
LookupAccountNameW
RegQueryValueExW
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExW
RegEnumKeyExW
RegOpenKeyA
RegQueryValueExA
RegQueryInfoKeyW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoCreateInstance
CoInitialize
CLSIDFromString

ntdll

RtlVirtualUnwind
NtQueryVirtualMemory
NtQuerySystemInformation
RtlInitUnicodeString
NtClose
NtQueryInformationProcess
RtlAddFunctionTable
RtlDeleteFunctionTable
RtlCaptureContext
NtQueryInformationThread
RtlLookupFunctionEntry
NtCreateFile

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CryptDecodeObject
CertGetNameStringW

ws2_32

htonl

Exports

Exports

CreateObject

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ed960d5e82f439fa7e9ddcaef8c5eff

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

userenv

wtsapi32

kernel32

user32

advapi32

shell32

ole32

ntdll

version

crypt32

ws2_32

Exports

Exports

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 77KB - Virtual size: 700KB

.pdata Size: 154KB - Virtual size: 153KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 54KB - Virtual size: 53KB

.vmp0 Size: 4.7MB - Virtual size: 4.7MB

.reloc Size: 25KB - Virtual size: 25KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 77KB - Virtual size: 700KB

.pdata
Size: 154KB - Virtual size: 153KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 54KB - Virtual size: 53KB

.vmp0
Size: 4.7MB - Virtual size: 4.7MB

.reloc
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 1KB - Virtual size: 1KB