c44de2817a87ef957e30a285a0b73836

Sharing

Copy URL Twitter E-mail

General

Target

c44de2817a87ef957e30a285a0b73836
Size

89KB
MD5

c44de2817a87ef957e30a285a0b73836
SHA1

e9e57a5dbf75481ed69fee3ec683c4849fce4ecd
SHA256

41ccc132d1c111c6e14e16123323ee921a968db3321e5ece370159219fcba312
SHA512

cdc575708908d5626ab4a5c24fe41e1f4aef3f904fdaae21bbe2a09a5fba63c46360c0ea8de4d46cf429143d6b1eb5354af8ddd4f04060fbfd883be24e871a33
SSDEEP

1536:U7cdXn5Y7+XxI7ZrX1TkdeEVhj1ko13nwlKNULtnfRFtQl8COAHb:ycdXn5Y7+XaZrFIdrfjv3njNULtnfRsP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c44de2817a87ef957e30a285a0b73836

Files

c44de2817a87ef957e30a285a0b73836
.dll windows:5 windows x86 arch:x86

eb5a2957a9a29c23c8c249385e76fdd9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

MD5Init
MD5Update
MD5Final
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
CryptImportKey
CryptDestroyKey
CryptHashData
CryptSignHashW
CryptDestroyHash
CreateProcessAsUserA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo

cabinet

ord23
ord22
ord20

ntdll

RtlEqualUnicodeString
ZwQuerySystemInformation
ZwSetInformationToken
ZwDuplicateToken
ZwAdjustPrivilegesToken
ZwOpenProcessToken
RtlInitUnicodeString
ZwClose
ZwQueryVolumeInformationFile
ZwOpenFile
qsort
RtlImageNtHeader
ZwAlertThread
strchr
_wcsicmp
_wcslwr
wcsstr
wcschr
RtlRemoveVectoredExceptionHandler
RtlAddVectoredExceptionHandler
sscanf
RtlGetFrame
RtlPushFrame
RtlPopFrame
RtlIpv4AddressToStringA
RtlReleasePebLock
ZwSetSystemPowerState
ZwCreateEventPair
ZwSetHighWaitLowEventPair
ZwWaitHighEventPair
ZwSetLowEventPair
RtlComputeCrc32
strstr
strncpy
_stricmp
ZwSetEvent
ZwUnmapViewOfSection
ZwOpenEvent
ZwOpenSection
ZwMapViewOfSection
ZwCreateEvent
ZwCreateSection
vsprintf
ZwQueryInformationProcess
RtlTimeToSecondsSince1970
RtlTimeToSecondsSince1980
ZwQueryInformationToken
RtlRandom
RtlImageDirectoryEntryToData
RtlExitUserThread
RtlIpv4StringToAddressA
RtlNtStatusToDosError
strpbrk
_strnicmp
_wcsnicmp
strrchr
wcsrchr
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
memcpy
memset
RtlAdjustPrivilege
RtlAcquirePebLock
_strlwr
ZwWaitForSingleObject
ZwDelayExecution
_snprintf
strtoul
swprintf
sprintf
_allmul

ws2_32

shutdown
WSASocketA
WSAStartup
WSARecvFrom
WSASendTo
setsockopt
WSASend
WSARecv
WSAIoctl
listen
bind
getsockname
WSASocketW
WSAGetLastError
closesocket

shlwapi

PathFindFileNameA
StrStrIA
SHGetValueA
PathRemoveBackslashW
SHSetValueA
SHRegCloseUSKey
SHRegCreateUSKeyA
PathRemoveBackslashA
PathFileExistsA
PathRemoveExtensionA

urlmon

ObtainUserAgentString
CoInternetSetFeatureEnabled
CreateURLMonikerEx
UrlMkSetSessionOption

kernel32

SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LocalFree
GetVersionExA
GetLocaleInfoA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetModuleHandleA
CreateWaitableTimerA
SetWaitableTimer
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
SetUnhandledExceptionFilter
GetCommandLineA
GetModuleFileNameA
CreateDirectoryA
OpenProcess
ExpandEnvironmentStringsW
FindClose
FindNextFileW
FindFirstFileW
ReadFile
GetFileSize
DeleteFileA
WaitForMultipleObjects
SetInformationJobObject
CreateJobObjectW
FlushFileBuffers
GetTempPathA
AssignProcessToJobObject
FreeLibrary
MultiByteToWideChar
CreateThread
Sleep
VirtualProtect
GetTickCount
GetSystemInfo
GetProcAddress
TerminateProcess
ResumeThread
SetThreadContext
GetThreadContext
WriteProcessMemory
VirtualAllocEx
CreateProcessA
LoadLibraryA
ExitProcess
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
ReleaseMutex
WaitForSingleObject
CloseHandle
SetEndOfFile
WriteFile
CreateFileA
CreateMutexA
VirtualAlloc
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
VirtualFree

user32

ExitWindowsEx
PostMessageW
SetTimer
DestroyWindow
PostQuitMessage
KillTimer
DefWindowProcW
RegisterClassW
CreateWindowExW
GetMessageW
GetClassNameW
TranslateMessage
DispatchMessageW
UnregisterClassW
GetClientRect
ChildWindowFromPoint
wsprintfW
SendMessageW
GetSystemMetrics

ole32

CreateBindCtx
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx
CoTaskMemAlloc

shell32

SHFileOperationW
ShellExecuteA

secur32

InitializeSecurityContextW
AcceptSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleW
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
QueryContextAttributesW
DecryptMessage

crypt32

CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CryptEncodeObject
CryptExportPublicKeyInfo
CryptDecodeObject
CertDuplicateCertificateContext
CertGetCertificateChain
CertSetCertificateContextProperty
CertCreateCertificateContext
CryptSignAndEncodeCertificate

wintrust

WinVerifyTrust

mswsock

AcceptEx

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb5a2957a9a29c23c8c249385e76fdd9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cabinet

ntdll

ws2_32

shlwapi

urlmon

kernel32

user32

ole32

shell32

secur32

crypt32

wintrust

mswsock

oleaut32

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 10KB - Virtual size: 22KB

.rsrc Size: 512B - Virtual size: 160B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 10KB - Virtual size: 22KB

.rsrc
Size: 512B - Virtual size: 160B

.reloc
Size: 6KB - Virtual size: 5KB