cd03032c0b7ca93eb8c63fbaef702acf

Sharing

Copy URL

Twitter E-mail

General

Target

cd03032c0b7ca93eb8c63fbaef702acf
Size

639KB
MD5

cd03032c0b7ca93eb8c63fbaef702acf
SHA1

edaa1bf89c8d5c58f108f816a8d4113613b7546a
SHA256

f49d1f0f8c95f8fa4d2c9e8d62731042dc692f63680f8f57ee2193df2c33cb70
SHA512

cf1716dae2c6352fdc75cf51a84c722b267a776c08ccbbab5d905029111c68bcec6d7db457b31a5320708bb8b85ff04357cee034c6d1b9e77d05c5abe8f2630e
SSDEEP

12288:CQlk3TBdpXhlIbkRM05SvEZ75w5fRqD45v0i03KGefkiCh7u:CgkDtXh+bkRMoSvKdMYKGefkx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd03032c0b7ca93eb8c63fbaef702acf

Files

cd03032c0b7ca93eb8c63fbaef702acf
.dll windows:6 windows x64 arch:x64

8bd7206b579a6cc38bd4ed47dd3b7fbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetFileApisToOEM
GetNamedPipeHandleStateA
FormatMessageW
PulseEvent
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
CreateFileMappingW
GetTickCount
CreateThread
Sleep
CreateEventW
CreateMutexA
WaitForSingleObject
ReleaseMutex
DeviceIoControl
GetOverlappedResult
CreatePipe
ReadConsoleOutputAttribute
CloseHandle
WriteFile
UnlockFile
SetFilePointer
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
BuildCommDCBAndTimeoutsW
GetLastError
GetSystemTimeAsFileTime
ReadFile
LockFile
GetFileSize
GetFileAttributesExA
CreateFileW
GetStdHandle

gdi32

CreateRectRgnIndirect
DeleteObject
RectInRegion
DeleteEnhMetaFile
CopyMetaFileA
GetEnhMetaFileW
Arc
DeleteColorSpace
CreateColorSpaceA
GetObjectA
ExtCreatePen
GetEnhMetaFileDescriptionA

advapi32

RegCloseKey
BackupEventLogW
CloseEventLog
OpenEventLogA
OpenEventLogW
OpenBackupEventLogW
RegEnumKeyExW
CredFree
CredMarshalCredentialW
SaferRecordEventLogEntry
SaferIdentifyLevel
SaferCloseLevel
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
LsaFreeMemory
ChangeServiceConfig2W
RegQueryValueExW
RegOpenKeyExW
ClearEventLogW

shell32

SHAppBarMessage
SHPathPrepareForWriteW
SHGetSettings
ord75
SHGetDiskFreeSpaceExA
ord245
SHGetFolderPathW
SHChangeNotify

shlwapi

StrCSpnW
StrPBrkW
StrStrIW
SHEnumValueW
SHRegCreateUSKeyA
SHRegCloseUSKey
SHRegGetUSValueA
SHRegSetUSValueA
SHRegQueryUSValueA
SHRegDeleteUSValueA
SHRegOpenUSKeyA

dbghelp

FindExecutableImage
SymCleanup
SymInitialize
SymGetSymPrev64

imm32

ImmGetConversionListW
ImmEscapeW
ImmGetCompositionFontA
ImmGetCandidateListCountA
ImmEnumRegisterWordA
ImmGetCompositionStringW

winmm

mmioOpenA
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetID
mixerClose
mixerOpen
mixerGetNumDevs
mmioGetInfo
mmioClose
mmioOpenW

rpcrt4

MesIncrementalHandleReset
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
MesEncodeFixedBufferHandleCreate
MesHandleFree
MesDecodeBufferHandleCreate
MesEncodeDynBufferHandleCreate
I_RpcMapWin32Status

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

iphlpapi

GetNetworkParams

vcruntime140

strrchr
strchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
memset
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
signal
_initterm
_cexit
strerror
system
exit
_errno
_invalid_parameter_noinfo_noreturn
_initterm_e
perror
_seh_filter_dll
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strncpy
isspace
isdigit
strtok
tolower
strncmp
isxdigit
_stricmp
_strdup
strncat
wcsncat
_wcsnicmp
wcsncpy
toupper

api-ms-win-crt-heap-l1-1-0

free
calloc
realloc
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

_ultoa
_ltoa
_itoa
strtoul
strtol
strtod
_itow
_ltow
_ultow
atoi

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
tmpfile
setbuf
rewind
fwrite
ftell
fclose
fflush
fopen
fputs
fseek
fread
_close
_open
_read
_write
fputc

api-ms-win-crt-time-l1-1-0

_time64
_difftime64

api-ms-win-crt-math-l1-1-0

exp
pow
sin
logf
_fdopen
log
floor
cos
sqrt
atan2

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-conio-l1-1-0

_getch

Exports

Exports

distorm_format_signed_disp
tre_add_tag_left
tre_ast_print
tre_compare_items
tre_filter_find
tre_regexecb
tre_regwnexec
tre_set_params
tre_tnfa_run_backtrack
xmalloc_impl

Sections

.text
Size: 512KB - Virtual size: 511KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

4
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8bd7206b579a6cc38bd4ed47dd3b7fbd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

shlwapi

dbghelp

imm32

winmm

rpcrt4

msvcp140

iphlpapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-conio-l1-1-0

Exports

Exports

Sections

.text Size: 512KB - Virtual size: 511KB

.rdata Size: 97KB - Virtual size: 97KB

.data Size: 4KB - Virtual size: 316KB

.pdata Size: 8KB - Virtual size: 7KB

.idata Size: 2KB - Virtual size: 2KB

4 Size: 12KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 484B

.text
Size: 512KB - Virtual size: 511KB

.rdata
Size: 97KB - Virtual size: 97KB

.data
Size: 4KB - Virtual size: 316KB

.pdata
Size: 8KB - Virtual size: 7KB

.idata
Size: 2KB - Virtual size: 2KB

4
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 484B