8b0abdfd7b59834d3bb0b9a7143cd8d4c9f16132c9a06d0f24fa534b32d9ead2

Sharing

Copy URL Twitter E-mail

General

Target

8b0abdfd7b59834d3bb0b9a7143cd8d4c9f16132c9a06d0f24fa534b32d9ead2
Size

3.9MB
MD5

2ac69262383235ec83eb9f4c2a3ff465
SHA1

0258f70bf37cb7eb40647c6b58b96dee8b04b173
SHA256

8b0abdfd7b59834d3bb0b9a7143cd8d4c9f16132c9a06d0f24fa534b32d9ead2
SHA512

28f49f10a95ea76c7c3a9d5e7b7117390c356abf0aa5aef4dcb4e537b27ec5ac75ab03462f05c4466861b5997305bddc26cbf645ebae2205e9e6d41ec6324127
SSDEEP

98304:cpkWiUI3011Zrju+rRKyUxbxMYFSE3zAWXyq5:xWiUIamFmmF5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b0abdfd7b59834d3bb0b9a7143cd8d4c9f16132c9a06d0f24fa534b32d9ead2

Files

8b0abdfd7b59834d3bb0b9a7143cd8d4c9f16132c9a06d0f24fa534b32d9ead2
.dll windows:6 windows x86 arch:x86

7561394aa256f85baa26b21259f128e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

gethostname
inet_pton
send
recvfrom
recv
sendto
WSAStringToAddressW
select
__WSAFDIsSet
WSARecv
listen
WSASocketW
shutdown
setsockopt
ioctlsocket
getsockopt
getpeername
WSASend
WSASetLastError
WSAAddressToStringW
WSAGetLastError
ntohl
WSAStartup
WSACleanup
ntohs
htons
htonl
closesocket
bind

kernel32

FindClose
FindFirstFileA
FindNextFileA
GetTempPathA
Sleep
VirtualQuery
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
FileTimeToSystemTime
GetWindowsDirectoryA
GetVersionExA
GetModuleHandleA
GetTimeZoneInformation
CreateFileW
GetFileSize
SetFilePointer
SetLastError
CreateProcessA
ProcessIdToSessionId
LoadLibraryA
lstrcmpiW
lstrcpyA
lstrcatA
GetLogicalDriveStringsA
QueryDosDeviceA
WTSGetActiveConsoleSessionId
MultiByteToWideChar
WideCharToMultiByte
Process32FirstW
Process32NextW
HeapFree
HeapAlloc
GetProcessHeap
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
GetEnvironmentVariableA
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FormatMessageA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsSetValue
TlsGetValue
SleepEx
SetEvent
CreateEventW
CreateIoCompletionPort
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
VerSetConditionMask
QueueUserAPC
TerminateThread
WaitForMultipleObjects
TlsFree
TlsAlloc
CreateWaitableTimerA
RaiseException
InitializeCriticalSectionEx
DecodePointer
GetCurrentThreadId
VirtualAlloc
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
InitializeCriticalSection
FreeLibrary
GetCurrentProcessId
DuplicateHandle
LocalFileTimeToFileTime
GetFileAttributesA
SystemTimeToFileTime
UnmapViewOfFile
GetFileInformationByHandle
CreateFileMappingA
MapViewOfFile
GetTickCount
lstrlenA
K32GetProcessImageFileNameA
FlushFileBuffers
OutputDebugStringW
WaitForSingleObjectEx
GlobalFree
CreateFileMappingW
GetSystemTime
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
HeapReAlloc
DeleteFileW
DeleteFileA
FlushViewOfFile
GetFileAttributesExW
GetDiskFreeSpaceA
HeapSize
HeapValidate
GetVersionExW
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
InterlockedCompareExchange
GetFullPathNameW
HeapCreate
AreFileApisANSI
LoadLibraryExA
VirtualFree
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
GetCPInfo
GetStringTypeW
GetModuleHandleExW
QueueUserWorkItem
IsProcessorFeaturePresent
TryEnterCriticalSection
EncodePointer
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
SwitchToThread
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameA
lstrcmpiA
ReadProcessMemory
VirtualQueryEx
VirtualProtectEx
GetSystemInfo
OpenProcess
WaitForSingleObject
WriteFile
ReadFile
GetFileSizeEx
CreateFileA
QueryPerformanceCounter
LocalFree
LoadResource
QueryPerformanceFrequency
LockResource
GetLastError
GetModuleHandleExA
RegisterWaitForSingleObject
LocalAlloc
CreateMutexA
FindResourceA
TerminateProcess
OutputDebugStringA
GetCurrentProcess
SizeofResource
CreateThread
CloseHandle
DisableThreadLibraryCalls
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetStdHandle
GetFileType
WriteConsoleW
GetDriveTypeW
CreateTimerQueueTimer
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitThread
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetEnvironmentVariableW
MoveFileExW
SetFilePointerEx
ExitProcess
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW
SetStdHandle
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetCurrentDirectoryA
GetProcessAffinityMask
SetThreadAffinityMask
FormatMessageW

user32

GetDesktopWindow
DefWindowProcA
GetClassInfoExA
LoadCursorA
RegisterClassExA
FindWindowExA
FindWindowExW
GetClassNameA
IsWindow
SetParent
GetParent
GetWindow
SetFocus
IsWindowVisible
ShowWindow
UpdateWindow
GetWindowRect
SetWindowPos
SetForegroundWindow
CallWindowProcA
BeginPaint
EndPaint
RegisterWindowMessageW
RegisterShellHookWindow
GetForegroundWindow
GetWindowThreadProcessId
CloseWindow
GetMessageA
DispatchMessageA
GetDC
GetAsyncKeyState
ReleaseDC
GetClientRect
SetCursor
UpdateLayeredWindow
GetCursorPos
GetClassInfoA
SetWindowsHookExA
UnhookWindowsHookEx
MoveWindow
GetWindowTextA
PostMessageA
SendMessageA
TranslateMessage
DestroyWindow
wsprintfW
CreateWindowExA
GetWindowLongA
PtInRect
SetWindowLongA
UnregisterClassA

gdi32

CreateCompatibleDC
GetObjectA
GetPixel
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateDCA
CreateDIBSection

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
CreateProcessAsUserW
OpenProcessToken
SetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupAccountSidA
ConvertSidToStringSidA
LookupAccountNameA
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA

shell32

SHGetSpecialFolderLocation
SHAppBarMessage
SHGetSpecialFolderPathA
SHCreateDirectoryExA
SHGetPathFromIDListA

ole32

OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoTaskMemFree
CoUninitialize
CoInitializeSecurity

bcrypt

BCryptGetProperty
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey

winhttp

WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpQueryOption
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSetCredentials
WinHttpReceiveResponse
WinHttpQueryHeaders

psapi

GetProcessImageFileNameA

iphlpapi

GetAdaptersInfo

shlwapi

PathRemoveFileSpecA
PathRemoveFileSpecW
PathFileExistsA
PathStripPathA
PathCombineA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

crypt32

CertGetNameStringA

mswsock

AcceptEx
GetAcceptExSockaddrs

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromFileICM
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM

comctl32

_TrackMouseEvent

wintrust

CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

Exports

Exports

CmdLineCb
Start
sqlite3_csv_init
sqlite3_shathree_init

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7561394aa256f85baa26b21259f128e1

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

bcrypt

winhttp

psapi

iphlpapi

shlwapi

userenv

crypt32

mswsock

gdiplus

comctl32

wintrust

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 402KB - Virtual size: 402KB

.data Size: 57KB - Virtual size: 82KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 81KB - Virtual size: 80KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 402KB - Virtual size: 402KB

.data
Size: 57KB - Virtual size: 82KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 81KB - Virtual size: 80KB