bcc22c13b0973c8857217595f16f0fb2

Sharing

Copy URL

Twitter E-mail

General

Target

bcc22c13b0973c8857217595f16f0fb2
Size

260KB
MD5

bcc22c13b0973c8857217595f16f0fb2
SHA1

1623af4396bd211421082455cc4756db1b304b5b
SHA256

caba3ba410474d9f53b476b1bfbf36553c2514909c40d0e2b0b6f3107145d92f
SHA512

6a928062c918dd5d49873ba28e323d233d2ca2b0687a2fa2d7109944d603982a1710810e5dfa7d8a32e099d2ea94aa0755b14c1f8b129a2d451be42bf6280103
SSDEEP

6144:cx+vcWk+LD9PdFAgqUDoTbext8kEDc19th8mB:ZvcZ+ZPdFqUbcDcMmB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcc22c13b0973c8857217595f16f0fb2

Files

bcc22c13b0973c8857217595f16f0fb2
.dll windows:4 windows x86 arch:x86

a10b1870faf138aec2edc2cfd2c8dc20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
CreateThread
GetTickCount
SystemTimeToFileTime
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetModuleFileNameW
LocalFree
CreateEventW
SetEvent
Sleep
LeaveCriticalSection
EnterCriticalSection
ResetEvent
OpenEventW
UnmapViewOfFile
RaiseException
MapViewOfFile
CreateFileMappingW
lstrcpynA
lstrlenA
MultiByteToWideChar
IsBadReadPtr
SetWaitableTimer
CancelWaitableTimer
GetLastError
CreateWaitableTimerW
OpenWaitableTimerW
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
ExitProcess
DisableThreadLibraryCalls
FreeLibraryAndExitThread
TerminateThread
GetVersionExW
GetCurrentThread
lstrcatA
GetSystemTimeAsFileTime
lstrcmpiW
lstrcmpW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OutputDebugStringW
SetFilePointer
OutputDebugStringA
SetEndOfFile
WriteFile
VirtualProtect
SetLastError
lstrcmpiA
lstrcpyA
GetVolumeInformationW
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTime
GetCurrentProcessId
WaitForMultipleObjects
FlushFileBuffers
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
VirtualQuery
Thread32Next
Thread32First
SuspendThread
ResumeThread
OpenThread
GetLongPathNameA
GetSystemInfo
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetFileSize
ReadFile
WideCharToMultiByte
MoveFileW
lstrcatW
GetLocalTime
ReleaseMutex
CreateMutexW
WaitForSingleObject
GetCurrentProcess
lstrcpyW
lstrlenW
FreeLibrary
lstrcpynW
CreateProcessW
CloseHandle
SetErrorMode
GetFileAttributesW
LoadLibraryA
GetProcAddress
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetOEMCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

DispatchMessageW
PeekMessageW
BroadcastSystemMessageW
MsgWaitForMultipleObjectsEx
IsCharAlphaW
IsCharAlphaNumericW
UpdateWindow
SendMessageW
FindWindowExW
wsprintfW
SetWindowTextW
UnregisterClassA
SetForegroundWindow
TranslateMessage
AllowSetForegroundWindow
wsprintfA
LockSetForegroundWindow
SetWindowsHookExW
PostMessageW
MsgWaitForMultipleObjects
CallNextHookEx
UnhookWindowsHookEx
EnumChildWindows

advapi32

OpenProcessToken
SetNamedSecurityInfoW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegFlushKey
RegNotifyChangeKeyValue
ImpersonateSelf
DuplicateTokenEx
GetLengthSid
SetTokenInformation
SetThreadToken
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

shell32

ord680
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

OleRun
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoFreeUnusedLibraries

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
VariantCopy
GetErrorInfo
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen

shlwapi

UrlEscapeW
StrStrIA
StrRStrIW
StrCmpNW
UrlUnescapeW
StrStrIW

ntdll

RtlUnwind
RtlZeroMemory

Exports

Exports

Startup
e
l
r

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a10b1870faf138aec2edc2cfd2c8dc20

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 179KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 12KB - Virtual size: 37KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 180KB - Virtual size: 179KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 37KB

.reloc
Size: 16KB - Virtual size: 15KB