ca8864e5eaa712a72aefae3048da037c

Sharing

Copy URL Twitter E-mail

General

Target

ca8864e5eaa712a72aefae3048da037c
Size

1012KB
MD5

ca8864e5eaa712a72aefae3048da037c
SHA1

a8f1473f8188c347a5a4c4d18d8ca0806835610e
SHA256

59ad082421e1442c6ebdab0883ca75f4d6bcdeaff1ff696b5ff07a2c4cf596d4
SHA512

a81192fee7258e307b126a13829feaedabfc95ab3fce6f526bf0b58efd3997895f5823bc20c83020adab17403b84c006c6fa21e244b1fe954e78059f14d2b22d
SSDEEP

12288:Qxp+VxPGB+1mBn9ukjXIP6z5ncG2ZQM329:Qxp+UB9hhXIP6z5n52yM32

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca8864e5eaa712a72aefae3048da037c

Files

ca8864e5eaa712a72aefae3048da037c
.dll windows:5 windows x64 arch:x64

698c3948fee7dc1b0fe6741e8cf47553

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WriteProfileStringA
GetConsoleDisplayMode
FindVolumeMountPointClose

advapi32

EqualSid
QueryServiceConfig2W

rasapi32

RasGetEapUserIdentityW

shlwapi

PathIsDirectoryEmptyW

user32

DdeClientTransaction
DdeSetUserHandle
UnhookWinEvent
GetDCEx
BeginDeferWindowPos
IsWow64Message

gdi32

AbortPath
PlayEnhMetaFileRecord

msvcrt

memset
rewind

rpcrt4

RpcBindingInqAuthInfoA
RpcErrorStartEnumeration
RpcSsContextLockExclusive

Exports

Exports

CopyPropVariant
CreatePropVariant
CreatePropertyStore
DestroyPropVariant
FormatTagFromWfx
GetAMSubtypeFromD3DFormat
GetD3DFormatFromMFSubtype
LFGetGlobalPool
MFAddPeriodicCallback
MFAllocateWorkQueue
MFAllocateWorkQueueEx
MFAppendCollection
MFAverageTimePerFrameToFrameRate
MFBeginCreateFile
MFBeginGetHostByName
MFBeginRegisterWorkQueueWithMMCSS
MFBeginUnregisterWorkQueueWithMMCSS
MFBlockThread
MFCalculateBitmapImageSize
MFCalculateImageSize
MFCancelCreateFile
MFCancelWorkItem
MFCompareFullToPartialMediaType
MFCompareSockaddrAddresses
MFConvertColorInfoFromDXVA
MFConvertColorInfoToDXVA
MFConvertFromFP16Array
MFConvertToFP16Array
MFCopyImage
MFCreateAMMediaTypeFromMFMediaType
MFCreateAlignedMemoryBuffer
MFCreateAsyncResult
MFCreateAttributes
MFCreateAudioMediaType
MFCreateCollection
MFCreateEventQueue
MFCreateFile
MFCreateGuid
MFCreateLegacyMediaBufferOnMFMediaBuffer
MFCreateMFByteStreamOnStream
MFCreateMFVideoFormatFromMFMediaType
MFCreateMediaBufferWrapper
MFCreateMediaEvent
MFCreateMediaType
MFCreateMediaTypeFromRepresentation
MFCreateMemoryBuffer
MFCreateMemoryStream
MFCreatePathFromURL
MFCreatePresentationDescriptor
MFCreateSample
MFCreateSocket
MFCreateSocketListener
MFCreateSourceResolver
MFCreateStreamDescriptor
MFCreateSystemTimeSource
MFCreateSystemUnderlyingClock
MFCreateTempFile
MFCreateTransformActivate
MFCreateURLFromPath
MFCreateUdpSockets
MFCreateVideoMediaType
MFCreateVideoMediaTypeFromBitMapInfoHeader
MFCreateVideoMediaTypeFromBitMapInfoHeaderEx
MFCreateVideoMediaTypeFromSubtype
MFCreateVideoMediaTypeFromVideoInfoHeader
MFCreateVideoMediaTypeFromVideoInfoHeader2
MFCreateWaveFormatExFromMFMediaType
MFDeserializeAttributesFromStream
MFDeserializeEvent
MFDeserializeMediaTypeFromStream
MFDeserializePresentationDescriptor
MFEndCreateFile
MFEndGetHostByName
MFEndRegisterWorkQueueWithMMCSS
MFEndUnregisterWorkQueueWithMMCSS
MFFrameRateToAverageTimePerFrame
MFFreeAdaptersAddresses
MFGetAdaptersAddresses
MFGetAttributesAsBlob
MFGetAttributesAsBlobSize
MFGetConfigurationDWORD
MFGetConfigurationPolicy
MFGetConfigurationStore
MFGetConfigurationString
MFGetIoPortHandle
MFGetMFTMerit
MFGetNumericNameFromSockaddr
MFGetPlaneSize
MFGetPlatform
MFGetPlatformVersion
MFGetPluginControl
MFGetPrivateWorkqueues
MFGetRandomNumber
MFGetSockaddrFromNumericName
MFGetStrideForBitmapInfoHeader
MFGetSystemTime
MFGetTimerPeriodicity
MFGetUncompressedVideoFormat
MFGetWorkQueueMMCSSClass
MFGetWorkQueueMMCSSTaskId
MFHeapAlloc
MFHeapFree
MFInitAMMediaTypeFromMFMediaType
MFInitAttributesFromBlob
MFInitMediaTypeFromAMMediaType
MFInitMediaTypeFromMFVideoFormat
MFInitMediaTypeFromMPEG1VideoInfo
MFInitMediaTypeFromMPEG2VideoInfo
MFInitMediaTypeFromVideoInfoHeader
MFInitMediaTypeFromVideoInfoHeader2
MFInitMediaTypeFromWaveFormatEx
MFInitVideoFormat
MFInitVideoFormat_RGB
MFInvokeCallback
MFIsFeatureEnabled
MFIsQueueThread
MFJoinIoPort
MFLockPlatform
MFLockWorkQueue
MFPlatformBigEndian
MFPlatformLittleEndian
MFPutWorkItem
MFPutWorkItemEx
MFRecordError
MFRemovePeriodicCallback
MFScheduleWorkItem
MFScheduleWorkItemEx
MFSerializeAttributesToStream
MFSerializeEvent
MFSerializeMediaTypeToStream
MFSerializePresentationDescriptor
MFSetSockaddrAny
MFShutdown
MFStartup
MFStreamDescriptorProtectMediaType
MFTEnum
MFTEnumEx
MFTGetInfo
MFTRegister
MFTRegisterLocal
MFTRegisterLocalByCLSID
MFTUnregister
MFTUnregisterLocal
MFTUnregisterLocalByCLSID
MFTraceError
MFTraceFuncEnter
MFUnblockThread
MFUnlockPlatform
MFUnlockWorkQueue
MFUnwrapMediaType
MFValidateMediaTypeSize
MFWrapMediaType
MFllMulDiv
PropVariantFromStream
PropVariantToStream
ValidateWaveFormat

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.exp
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qdata
Size: 208KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.odknqw
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kuyprn
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nab
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hcstxj
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ejlgx
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.twakk
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jbfgrf
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kefj
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.psr
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dxoc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idlhj
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.acyhwx
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qnykpr
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sbqmmu
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iiquh
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vuodnv
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hwxe
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cwoa
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dazqv
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hmyg
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.splael
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aomep
Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.stvpnr
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tqgei
Size: 4KB - Virtual size: 905B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wuzfdl
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hsgyi
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

698c3948fee7dc1b0fe6741e8cf47553

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

rasapi32

shlwapi

user32

gdi32

msvcrt

rpcrt4

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 20KB - Virtual size: 18KB

.pdata Size: 4KB - Virtual size: 360B

.exp Size: 212KB - Virtual size: 211KB

.qdata Size: 208KB - Virtual size: 206KB

.rsrc Size: 4KB - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 2KB

.odknqw Size: 4KB - Virtual size: 2KB

.kuyprn Size: 4KB - Virtual size: 503B

.nab Size: 4KB - Virtual size: 2KB

.hcstxj Size: 4KB - Virtual size: 1KB

.ejlgx Size: 208KB - Virtual size: 205KB

.twakk Size: 4KB - Virtual size: 3KB

.jbfgrf Size: 4KB - Virtual size: 503B

.kefj Size: 4KB - Virtual size: 1KB

.psr Size: 208KB - Virtual size: 205KB

.dxoc Size: 4KB - Virtual size: 1KB

.idlhj Size: 4KB - Virtual size: 1KB

.acyhwx Size: 4KB - Virtual size: 1KB

.qnykpr Size: 4KB - Virtual size: 1KB

.sbqmmu Size: 4KB - Virtual size: 1KB

.iiquh Size: 4KB - Virtual size: 1KB

.vuodnv Size: 4KB - Virtual size: 2KB

.hwxe Size: 4KB - Virtual size: 1KB

.cwoa Size: 4KB - Virtual size: 2KB

.dazqv Size: 4KB - Virtual size: 2KB

.hmyg Size: 4KB - Virtual size: 503B

.splael Size: 4KB - Virtual size: 503B

.aomep Size: 4KB - Virtual size: 503B

.stvpnr Size: 4KB - Virtual size: 3KB

.tqgei Size: 4KB - Virtual size: 905B

.wuzfdl Size: 28KB - Virtual size: 27KB

.hsgyi Size: 8KB - Virtual size: 5KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 20KB - Virtual size: 18KB

.pdata
Size: 4KB - Virtual size: 360B

.exp
Size: 212KB - Virtual size: 211KB

.qdata
Size: 208KB - Virtual size: 206KB

.rsrc
Size: 4KB - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 2KB

.odknqw
Size: 4KB - Virtual size: 2KB

.kuyprn
Size: 4KB - Virtual size: 503B

.nab
Size: 4KB - Virtual size: 2KB

.hcstxj
Size: 4KB - Virtual size: 1KB

.ejlgx
Size: 208KB - Virtual size: 205KB

.twakk
Size: 4KB - Virtual size: 3KB

.jbfgrf
Size: 4KB - Virtual size: 503B

.kefj
Size: 4KB - Virtual size: 1KB

.psr
Size: 208KB - Virtual size: 205KB

.dxoc
Size: 4KB - Virtual size: 1KB

.idlhj
Size: 4KB - Virtual size: 1KB

.acyhwx
Size: 4KB - Virtual size: 1KB

.qnykpr
Size: 4KB - Virtual size: 1KB

.sbqmmu
Size: 4KB - Virtual size: 1KB

.iiquh
Size: 4KB - Virtual size: 1KB

.vuodnv
Size: 4KB - Virtual size: 2KB

.hwxe
Size: 4KB - Virtual size: 1KB

.cwoa
Size: 4KB - Virtual size: 2KB

.dazqv
Size: 4KB - Virtual size: 2KB

.hmyg
Size: 4KB - Virtual size: 503B

.splael
Size: 4KB - Virtual size: 503B

.aomep
Size: 4KB - Virtual size: 503B

.stvpnr
Size: 4KB - Virtual size: 3KB

.tqgei
Size: 4KB - Virtual size: 905B

.wuzfdl
Size: 28KB - Virtual size: 27KB

.hsgyi
Size: 8KB - Virtual size: 5KB