deda7e09c206758b706af8539064a84b

Sharing

Copy URL Twitter E-mail

General

Target

deda7e09c206758b706af8539064a84b
Size

348KB
MD5

deda7e09c206758b706af8539064a84b
SHA1

412388a039affe50a8b3c550975792dda7c1faf9
SHA256

abc39d86054077f3bf5bfa609a9b2983d39f36a7397a631dec0862b71922cb53
SHA512

489877ce84d648496ba690f0e22b4c0f7edaa7feada651f640a6db45a98f7efc3b74c8a653ed5103b85a46f83139eb90e652e29df897d674a63338a22fc0f7c1
SSDEEP

6144:htlIKNDXGJ9kAL5SUemDDPs/sRjG8IRW:hnIHaA9DD0ERh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deda7e09c206758b706af8539064a84b

Files

deda7e09c206758b706af8539064a84b
.dll windows:4 windows x86 arch:x86

75a9fde7141600916daea0fcf89560c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitThread
GetCommandLineA
GetACP
GetFileType
HeapSize
HeapReAlloc
SetHandleCount
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
FreeEnvironmentStringsA
RaiseException
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
GetFileInformationByHandle
InterlockedExchange
ExitProcess
RtlUnwind
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetOEMCP
GetCPInfo
GetProcessVersion
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
WritePrivateProfileStringA
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcatA
GetFileSize
GetFileAttributesA
DeleteCriticalSection
GlobalFlags
GlobalDeleteAtom
lstrcmpA
FindNextFileA
GetModuleFileNameA
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
lstrcpyA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
GlobalLock
GlobalUnlock
SetLastError
lstrlenA
LocalFree
FreeConsole
SetHandleInformation
CreateEventA
GetStdHandle
SetStdHandle
PeekNamedPipe
WriteFile
SetEvent
CreateToolhelp32Snapshot
Process32First
Process32Next
GetComputerNameA
OutputDebugStringA
CreateThread
WaitForMultipleObjectsEx
lstrcmpiA
GetLogicalDriveStringsA
GetDriveTypeA
GetModuleHandleA
GetDiskFreeSpaceA
MultiByteToWideChar
WideCharToMultiByte
GetSystemInfo
ReadProcessMemory
VirtualQueryEx
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcess
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
CreateFileA
GetFileTime
SetFileTime
TerminateThread
SetEnvironmentVariableA
CreatePipe
GetStartupInfoA
CreateProcessA
CloseHandle
ReadFile
TerminateProcess
FormatMessageA
InitializeCriticalSection
GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetTickCount
CreateDirectoryA
GetCurrentDirectoryA
GetEnvironmentVariableA
GlobalAlloc
GlobalFree
Sleep
DeleteFileA
GetLongPathNameA
GetCurrentProcessId
FreeEnvironmentStringsW
OpenProcess

user32

GetSysColor
AdjustWindowRectEx
GetClientRect
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
IsIconic
GetWindowPlacement
GetMenuItemCount
LoadStringA
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
MapWindowPoints
UnhookWindowsHookEx
GetWindowTextA
SetWindowTextA
ExitWindowsEx
GetSystemMetrics
DestroyMenu
GetSysColorBrush
LoadCursorA
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
CharUpperA
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
ClientToScreen
SetProcessWindowStation
CloseWindowStation
SetThreadDesktop
CloseDesktop
GetUserObjectSecurity
SetUserObjectSecurity
GetProcessWindowStation
GetThreadDesktop
GetLastInputInfo
LoadIconA
SystemParametersInfoA
wsprintfA

gdi32

PtVisible
RectVisible
ExtTextOutA
Escape
CreateBitmap
GetDeviceCaps
DeleteObject
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateDCA
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
TextOutA
GetDIBits
GetObjectA

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

LookupAccountSidA
DuplicateTokenEx
ImpersonateLoggedOnUser
AllocateLocallyUniqueId
SetTokenInformation
BuildExplicitAccessWithNameA
SetEntriesInAclA
MakeAbsoluteSD
IsValidSecurityDescriptor
SetServiceStatus
RegisterServiceCtrlHandlerA
GetAclInformation
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
IsValidSid
GetLengthSid
CopySid
LogonUserA
CreateProcessAsUserA
GetTokenInformation
AdjustTokenPrivileges
RegDeleteValueA
RegFlushKey
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
RegQueryValueExA
RegCloseKey
GetServiceKeyNameA
DeleteService
OpenEventLogA
ClearEventLogA
CloseEventLog
StartServiceA
OpenSCManagerA
OpenServiceA
ControlService
QueryServiceStatus
CloseServiceHandle
LookupAccountNameA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA

comctl32

ord17

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ws2_32

inet_ntoa
htons
WSAGetLastError
gethostbyname
gethostname
closesocket
recv
setsockopt
WSAIoctl
bind
socket
ntohs
WSAStartup
getsockname
select
connect
inet_addr
ioctlsocket
send
__WSAFDIsSet
sendto
listen
accept
WSCEnumProtocols

Exports

Exports

ServiceMain

Sections

.text
Size: 240KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75a9fde7141600916daea0fcf89560c1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

netapi32

ws2_32

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 236KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 32KB - Virtual size: 87KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 240KB - Virtual size: 236KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 32KB - Virtual size: 87KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 24KB - Virtual size: 23KB