eee56f5578a5dc19c1ae87017d70d0c0ffc24013943b32e7f7ef8c18f47c3c33

Sharing

Copy URL Twitter E-mail

General

Target

eee56f5578a5dc19c1ae87017d70d0c0ffc24013943b32e7f7ef8c18f47c3c33
Size

122KB
MD5

363435517465f2bb07a7696fa8d85636
SHA1

e66d3145e6a1362e8bdf790fb640ae9694810604
SHA256

eee56f5578a5dc19c1ae87017d70d0c0ffc24013943b32e7f7ef8c18f47c3c33
SHA512

8f8ed0814ad3ac586c9a77adaf9638218518e7e55ab91f99edd9367ce1fcc77a3fff12b593465d35644ee8078ff81171acf009cff3db281110bbfdaa477e82b8
SSDEEP

3072:ZqKhahBIuZT5TChpeBD88SYeHYiSdu25mX5yII:0KhEBnTNiYu2LZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eee56f5578a5dc19c1ae87017d70d0c0ffc24013943b32e7f7ef8c18f47c3c33

Files

eee56f5578a5dc19c1ae87017d70d0c0ffc24013943b32e7f7ef8c18f47c3c33
.dll regsvr32 windows:5 windows x86 arch:x86

6198e89cd02fdd46311bbb942c95dc0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
lstrcpyW
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
HeapDestroy
lstrcpynW
DisableThreadLibraryCalls
GlobalUnlock
GlobalLock
LoadLibraryExW
lstrcatW
lstrlenA
SizeofResource
lstrcmpW
GetCurrentThreadId
VirtualQuery
CreateEventW
WaitForSingleObject
MulDiv
CreateThread
SetEvent
InterlockedExchangeAdd
IsBadReadPtr
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
GetSystemInfo
VirtualAlloc
VirtualProtect
GetVersionExW
GetSystemDirectoryW
GlobalAlloc
OutputDebugStringA
WriteFile
IsBadStringPtrW
FindResourceW
LoadResource
LockResource
SetLastError
GetLastError
GetTempPathW
GetTempFileNameW
GetCurrentThread
LocalAlloc
CreateFileW
LocalFree
CloseHandle
HeapAlloc
GetCurrentProcess
FlushInstructionCache
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
LoadLibraryW
LoadLibraryA
lstrlenW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
DeleteFileW
GlobalFree
GetModuleHandleExW
GetModuleFileNameW
GetProcessHeap
HeapFree
InterlockedDecrement
RaiseException
InterlockedIncrement
Sleep

msvcrt

wcsstr
wcscat
??2@YAPAXI@Z
__CxxFrameHandler
wcsncpy
wcsrchr
swprintf
fseek
ftell
_wfopen
fread
fclose
??3@YAXPAX@Z
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_adjust_fdiv
_initterm
_wcsicmp
qsort
bsearch
wcslen
wcscpy
free
malloc
_wcsdup
memmove
_except_handler3
realloc
_purecall
fwprintf
_iob

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z

user32

GetFocus
MessageBoxW
GetPropW
SetPropW
CharNextW
RegisterClassExW
GetClassInfoExW
GetWindow
GetWindowTextW
GetWindowTextLengthW
LoadCursorW
RegisterWindowMessageW
CharPrevW
GetSysColor
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
SetFocus
IsChild
EndPaint
FillRect
BeginPaint
RedrawWindow
ShowScrollBar
CreateAcceleratorTableW
wsprintfW
EndDialog
ScreenToClient
UpdateWindow
ShowWindow
IsWindowVisible
SetTimer
KillTimer
SendDlgItemMessageW
DialogBoxParamW
GetSystemMetrics
DrawTextW
EnableWindow
IsWindowEnabled
DefWindowProcW
GetDC
ReleaseDC
SetDlgItemTextW
IsWindow
GetParent
SendMessageW
GetScrollInfo
PtInRect
GetWindowRect
MoveWindow
GetClientRect
GetDlgItem
SetWindowTextW
PostMessageW
GetDesktopWindow
DestroyWindow
CreateDialogIndirectParamW
CreateWindowExW
SetWindowPos
LoadImageW
SystemParametersInfoW
LoadStringW
HideCaret
DrawFocusRect
MapWindowPoints
SetWindowLongW
GetDlgCtrlID
CallWindowProcW
GetClassNameW
GetWindowLongW

gdi32

SetTextColor
CreateSolidBrush
BitBlt
DeleteDC
GetStockObject
GetObjectType
CreateFontIndirectW
GetTextMetricsW
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SelectPalette
RealizePalette
GetDeviceCaps
DeleteObject

advapi32

CryptAcquireContextW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenThreadToken
OpenProcessToken
GetTokenInformation
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptSetKeyParam
CryptImportKey
SetNamedSecurityInfoW

ole32

OleLockRunning
StringFromCLSID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromProgID
StringFromGUID2

shell32

SHCreateDirectoryExW
ShellExecuteW

oleaut32

SysAllocStringLen
VariantInit
SysFreeString
VariantClear
OleLoadPicturePath
LoadRegTypeLi
SysStringLen
SysAllocString
VariantCopy
LoadTypeLi
RegisterTypeLi
VarUI4FromStr

rpcrt4

UuidFromStringW

shlwapi

PathIsRootW
PathRenameExtensionW
PathAppendW
PathRemoveFileSpecW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ServiceMain

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6198e89cd02fdd46311bbb942c95dc0f

Headers

File Characteristics

Imports

kernel32

msvcrt

msvcp60

user32

gdi32

advapi32

ole32

shell32

oleaut32

rpcrt4

shlwapi

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 7KB - Virtual size: 6KB