ad7ca15794e82cc1f74b1e1b545052cb

Sharing

Copy URL Twitter E-mail

General

Target

ad7ca15794e82cc1f74b1e1b545052cb
Size

189KB
MD5

ad7ca15794e82cc1f74b1e1b545052cb
SHA1

9cd0caa9efcc5a14cd96016014afd7d9e992b567
SHA256

21fd5d2beb3c83550c08bb319fb28a9a8e07f30c52ba1d90977eecd4207f2e94
SHA512

b070f2886c776382519f10632ec347e3769e93b2c1daded77de5cdf8629858570e97768c26d2bcf3f20db9194fdf099a5ab3da8b8a7326383feb7a485b565cae
SSDEEP

3072:V3+Naast4JF5Z24EnzlZWCD8xTkMHAB63GwxbircEfKgUuez4UP+wQTlimBo6gSe:Vdt4JF5ZIMgByxbirxSgU3DP+wiD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad7ca15794e82cc1f74b1e1b545052cb

Files

ad7ca15794e82cc1f74b1e1b545052cb
.dll windows:5 windows x86 arch:x86

7b92300fc81a78e9d512f76a314b6011

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

sti_ci.pdb

Imports

msvcrt

_snprintf
sprintf
_vsnprintf
strrchr
wcsncpy
_wcsicmp
wcsstr
_except_handler3
_adjust_fdiv
malloc
_initterm
free
_snwprintf

advapi32

ChangeServiceConfigW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyW
CloseServiceHandle
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
OpenSCManagerW
RegDeleteValueW
QueryServiceStatus
ControlService
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegSetValueExA
RegCreateKeyA
RegSetValueW
RegCreateKeyExA

gdi32

DeleteDC
GetDeviceCaps
CreateDCW
CreateFontIndirectW

kernel32

lstrcatW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
Sleep
WaitForSingleObject
LocalFree
CloseHandle
ReleaseMutex
CompareStringW
GetPrivateProfileStringW
GetWindowsDirectoryW
CreateProcessW
DeleteFileW
lstrcmpiW
lstrcmpW
MultiByteToWideChar
lstrcpyA
CompareStringA
lstrcpynW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenW
lstrcpyW
SetLastError
LocalAlloc
GetModuleHandleW
GetModuleFileNameW
WriteFile
HeapFree
CreateMutexA
HeapAlloc
GetProcessHeap
FlushFileBuffers
SetFilePointerEx
CreateFileA
ExpandEnvironmentStringsA
GetLocalTime
GetModuleFileNameA
lstrcpynA
CreateMutexW

user32

FindWindowW
SetForegroundWindow
wsprintfW
ShowWindow
SetWindowTextW
SystemParametersInfoW
MessageBoxW
LoadIconW
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItem
SetFocus
LoadStringW
IsWindow
GetWindowLongW
SetWindowLongW
GetParent
SendMessageW
GetActiveWindow

ole32

CoInitialize
CoUninitialize
CoCreateInstance

cfgmgr32

CM_Get_DevNode_Status

setupapi

SetupDefaultQueueCallbackW
SetupGetStringFieldW
SetupFindFirstLineW
SetupDiRegisterDeviceInfo
SetupCloseInfFile
SetupDiGetActualSectionToInstallW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiGetSelectedDevice
SetupQueryInfVersionInformationW
SetupGetInfInformationW
SetupDiGetDriverInstallParamsW
SetupDiEnumDriverInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiClassGuidsFromNameW
SetupDiSetSelectedDevice
SetupDiOpenDeviceInterfaceRegKey
SetupDiEnumDeviceInterfaces
SetupDiSetClassInstallParamsW
SetupDiGetClassInstallParamsW
SetupDiGetWizardPage
SetupDiCallClassInstaller
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiCreateDeviceInfoW
SetupDiClassNameFromGuidW
SetupDiCreateDeviceInfoList
SetupDiRemoveDevice
SetupDiDeleteDevRegKey
SetupDiRemoveDeviceInterface
SetupDiDeleteDeviceInterfaceRegKey
SetupDiGetDeviceInterfaceDetailW
SetupFindNextLine
SetupDiCreateDeviceInterfaceRegKeyW
SetupOpenAppendInfFileW
SetupDiCreateDeviceInterfaceW
SetupTermDefaultQueueCallback
SetupDiInstallDevice
SetupInitDefaultQueueCallbackEx
SetupDiCreateDevRegKeyW
SetupDiSetDriverInstallParamsW

shell32

SHSetLocalizedName
SHGetFolderPathW

mscms

InstallColorProfileW
AssociateColorProfileWithDeviceW

Exports

Exports

??0BUFFER@@QAE@I@Z
??0BUFFER_CHAIN@@QAE@XZ
??0BUFFER_CHAIN_ITEM@@QAE@I@Z
??1BUFFER@@QAE@XZ
??1BUFFER_CHAIN@@QAE@XZ
??1BUFFER_CHAIN_ITEM@@QAE@XZ
??_FBUFFER@@QAEXXZ
??_FBUFFER_CHAIN_ITEM@@QAEXXZ
?CreateWiaShortcut@@YGHXZ
?DeleteWiaShortcut@@YGHXZ
?QueryPtr@BUFFER@@QBEPAXXZ
?QuerySize@BUFFER@@QBEIXZ
?QueryUsed@BUFFER_CHAIN_ITEM@@QBEKXZ
?SetUsed@BUFFER_CHAIN_ITEM@@QAEXK@Z
?WiaDeviceEnum@@YGHXZ
AddDevice
ClassInstall
CoinstallerEntry
InstallWiaService
MigrateDevice
WiaAddDevice
WiaCreatePortList
WiaCreateWizardMenu
WiaDestroyPortList
WiaRemoveDevice

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b92300fc81a78e9d512f76a314b6011

Headers

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

gdi32

kernel32

user32

ole32

cfgmgr32

setupapi

shell32

mscms

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 57KB - Virtual size: 57KB

.rsrc Size: 44KB - Virtual size: 44KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 57KB - Virtual size: 57KB

.rsrc
Size: 44KB - Virtual size: 44KB

.reloc
Size: 7KB - Virtual size: 6KB