ac40e74773f974745e19c6c7ff02969a07e1810b98dab56abbadb2faf6a55191

Sharing

Copy URL Twitter E-mail

General

Target

ac40e74773f974745e19c6c7ff02969a07e1810b98dab56abbadb2faf6a55191
Size

4.1MB
MD5

d58856adc38d029691638a613f57dbb3
SHA1

1234317249a2b18ae5bf18f64b56e5de046a384d
SHA256

ac40e74773f974745e19c6c7ff02969a07e1810b98dab56abbadb2faf6a55191
SHA512

3fc5af88fa3d3d73fcbb796148d0cdaad14be125d8de36af33dbe760a41993b8d18e174f35794fb636d47cc88a41f17cd6cc4372986fc331bcfa79ba6b05bbda
SSDEEP

98304:qXu+3e6/zb009SCnVkrpof3ucCOjFUi8BE7XafREH8nf5ZlJfr:qXRe6/zb0KSIgq/uB9u2ecnfjlJf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac40e74773f974745e19c6c7ff02969a07e1810b98dab56abbadb2faf6a55191

Files

ac40e74773f974745e19c6c7ff02969a07e1810b98dab56abbadb2faf6a55191
.dll windows:6 windows x86 arch:x86

5773fdc21314fdfbab1f4df2ab4b47dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetSecurityInfo
SetSecurityInfo
InitializeSecurityDescriptor
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
GetAce
GetAclInformation
SetSecurityDescriptorDacl
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
RegOpenKeyExA
OpenSCManagerW
CloseServiceHandle
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptDestroyHash

kernel32

InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
CreateEventW
HeapAlloc
VerSetConditionMask
GetProcessHeap
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateIoCompletionPort
LocalAlloc
CreateFileW
DeviceIoControl
InitializeCriticalSectionEx
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
RaiseException
DecodePointer
GetModuleHandleW
FormatMessageW
WaitForSingleObjectEx
GlobalFree
GetModuleFileNameW
MultiByteToWideChar
GetCurrentProcess
GetProcAddress
WriteConsoleW
SetEndOfFile
SetLastError
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapSize
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleMode
HeapFree
TlsSetValue
SetWaitableTimer
DeleteFileW
SetFileAttributesW
CreateDirectoryW
CreateEventA
FormatMessageA
TlsFree
WideCharToMultiByte
DeleteCriticalSection
LocalFree
QueueUserAPC
CloseHandle
TlsAlloc
TerminateThread
FileTimeToSystemTime
GetConsoleOutputCP
WriteFile
SetEvent
SetEnvironmentVariableW
PostQueuedCompletionStatus
WaitForSingleObject
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
GetLastError
CreateWaitableTimerW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LCMapStringEx
GetStringTypeW
GetCPInfo
ResetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
OpenEventA
Sleep
GetCurrentProcessId
ResumeThread
GetModuleHandleA
CreateWaitableTimerA
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemDirectoryW
FreeLibrary
LoadLibraryW
GetTickCount
GetEnvironmentVariableA
MoveFileExW
GetFileSizeEx
ReadFile
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
SetFilePointerEx
GetStdHandle
GetTimeZoneInformation
FlushFileBuffers
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

SHGetFolderPathW

ole32

CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance

oleaut32

SafeArrayGetElement
SysFreeString
SysAllocString
VariantClear
SysStringLen
SysAllocStringLen

ws2_32

WSAStartup
WSACleanup
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSAIoctl
getaddrinfo
recv
WSASetLastError
closesocket
freeaddrinfo
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket

winhttp

WinHttpSetTimeouts
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpen

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

shlwapi

PathAppendW

iphlpapi

GetAdaptersInfo

Exports

Exports

?DeleteProductKey@@YAXI@Z
?GetPPDetails@@YAJPAUPartialProductDetails@@@Z
?SetProgressDelegate@@YAXP6AXH@Z@Z
Activate
ActivateEx
ActivateFromFile
ActivationRequestToFile
ActivationRequestToFileEx
CheckAndSavePKey
Deactivate
DeactivationRequestToFile
ExtendTrial
GetCurrentProduct
GetExtraData
GetFeatureValue
GetPKey
IsActivated
IsDateValid
IsGenuine
IsGenuineEx
IsProductKeyValid
PDetsFromPath
SetCurrentProduct
SetCustomActDataPath
SetCustomProxy
TA_Activate
TA_ActivateFromFile
TA_ActivationRequestToFile
TA_CheckAndSavePKey
TA_Cleanup
TA_Deactivate
TA_DeactivationRequestToFile
TA_ExtendTrial
TA_GenuineDays
TA_GetExtraData
TA_GetFeatureValue
TA_GetHandle
TA_GetPKey
TA_GetVersion
TA_IsActivated
TA_IsDateValid
TA_IsGenuine
TA_IsGenuineEx
TA_IsProductKeyValid
TA_PDetsFromByteArray
TA_PDetsFromPath
TA_SetCustomActDataPath
TA_SetCustomProxy
TA_SetTrialCallback
TA_TrialDaysRemaining
TA_UseTrial
TA_UseTrialVerifiedFromFile
TA_UseTrialVerifiedRequest
TrialDaysRemaining
UseTrial

Sections

.text
Size: - Virtual size: 706KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.<]J
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zx1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.!Q&
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5773fdc21314fdfbab1f4df2ab4b47dc

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

shell32

ole32

oleaut32

ws2_32

winhttp

bcrypt

crypt32

shlwapi

iphlpapi

Exports

Exports

Sections

.text Size: - Virtual size: 706KB

.rdata Size: - Virtual size: 306KB

.data Size: - Virtual size: 38KB

.<]J Size: - Virtual size: 1.7MB

.zx1 Size: 1KB - Virtual size: 1KB

.!Q& Size: 4.1MB - Virtual size: 4.1MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: - Virtual size: 706KB

.rdata
Size: - Virtual size: 306KB

.data
Size: - Virtual size: 38KB

.<]J
Size: - Virtual size: 1.7MB

.zx1
Size: 1KB - Virtual size: 1KB

.!Q&
Size: 4.1MB - Virtual size: 4.1MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 2KB