dfd845734b26e8fb25189743719745d3

Sharing

Copy URL Twitter E-mail

General

Target

dfd845734b26e8fb25189743719745d3
Size

944KB
MD5

dfd845734b26e8fb25189743719745d3
SHA1

ba6d34155851b4c1de306319658ef4441a32c6fb
SHA256

e379356aec730f9d3160abbc802fd8b9bf22cf77bf262fb2f92bc93d1b0cbff1
SHA512

cc59e92c5f03bc5b15573a80a4bdf4ebb372ac98c703fc0d0d02710377a6dd5ec48eae01e3a36ca2ac11015ced604a681d3c52063eb1d1e7bec25add39135f25
SSDEEP

12288:pNZG5+zzMcssIUkV8/EiSbPQPY0zRwZWl8/ElERXpLsJTvrbgKEIeYY62BDT9WO:pNHDssXka/yPQPYlYfeZebgKEIeqmvf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfd845734b26e8fb25189743719745d3

Files

dfd845734b26e8fb25189743719745d3
.dll regsvr32 windows:5 windows x86 arch:x86

f1b88c1678c1d10d0d7781cdbe373997

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_BIND

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

obemetal.pdb

Imports

shlwapi

StrDupA
PathAddExtensionW
StrFormatByteSizeW
StrCmpNIA
StrPBrkW
PathCombineA
SHDeleteKeyA
StrRChrA
StrStrA
ChrCmpIW
SHGetValueA
SHSetValueA
StrCmpNW
ord265
ord263
SHRegGetBoolUSValueW
UrlCreateFromPathW
SHDeleteKeyW
UrlHashW
UrlCombineW
StrStrIW
StrChrIW
ord462
PathStripPathA
SHCreateShellPalette
SHGetInverseCMAP
SHRegGetUSValueW
StrCatBuffA
PathAddBackslashA
SHStrDupW
PathIsRelativeW
wvnsprintfA
StrCpyW
StrChrA
PathIsUNCA
StrCmpW
SHEnumKeyExW
SHRegOpenUSKeyW
SHRegDeleteUSValueW
SHRegCloseUSKey
ord389
PathIsDirectoryW
SHCopyKeyW
StrToIntA
StrCSpnW
StrDupW
StrChrW
PathRemoveExtensionW
PathAddBackslashW
HashData
StrTrimW
StrRStrIW
SHDeleteValueW
SHSetValueW
PathGetDriveNumberW
SHGetValueW
PathFindExtensionW
PathIsURLW
StrStrW
StrCmpNIW
SHCreateStreamOnFileW
PathAppendW
PathRemoveFileSpecW
StrRChrW
StrNCatW
PathFileExistsW
StrCatBuffW
PathCombineW
PathAppendA
PathRemoveFileSpecA
wnsprintfA
PathFindFileNameA
StrToIntW
PathFindFileNameW
UrlGetPartW
StrCmpIW
wnsprintfW
StrCpyNW
StrCmpNA

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegSetValueA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenThreadToken
LogonUserW
LookupAccountNameW
RegLoadKeyW
RegUnLoadKeyW
CryptDecrypt
CryptDestroyKey
CryptDeriveKey
RegEnumValueW
RegEnumValueA
RegSetValueExW
RegSetValueW
RegQueryValueExW
RegQueryValueExA
RegQueryValueW
RegQueryValueA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyW
RegOpenKeyA
RegEnumKeyExW
RegEnumKeyExA
RegEnumKeyW
RegEnumKeyA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegSetValueExA
RegCreateKeyExW
RegCreateKeyW
RegCreateKeyA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessDeniedAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
GetAce
RegCloseKey

user32

DispatchMessageA
GetForegroundWindow
GetClientRect
MapWindowPoints
InvalidateRect
ShowWindow
GetParent
SetTimer
KillTimer
GetDlgItem
EndDialog
DestroyWindow
MoveWindow
GetDC
ReleaseDC
SetFocus
IsWindow
GetWindowTextA
SetCursor
CreatePopupMenu
GetKeyState
SetWindowPos
GetMessageTime
ReleaseCapture
SetCapture
SendMessageTimeoutW
SendDlgItemMessageW
FindWindowW
RegisterClassExW
RegisterClassExA
SetMenuItemInfoW
SetMenuItemInfoA
DrawTextExW
DrawTextExA
WinHelpW
WinHelpA
UnregisterClassW
SystemParametersInfoW
SetWindowTextW
SetWindowTextA
SetPropW
SetPropA
SendMessageW
SendMessageA
SendMessageTimeoutA
RemovePropW
RemovePropA
RegisterWindowMessageW
RegisterClassW
RegisterClassA
MessageBoxIndirectW
MessageBoxIndirectA
InsertMenuW
LoadImageW
GetWindowTextW
GetPropW
GetPropA
MessageBoxW
MessageBoxA
GetClassNameW
GetClassNameA
GetClassInfoW
GetClassInfoA
FindWindowExW
DrawTextW
CreateWindowExW
CreateWindowExA
CharUpperW
CharLowerW
GetMenuItemInfoW
GetMenuItemInfoA
TranslateAcceleratorW
TranslateAcceleratorA
SetWindowsHookExW
SetWindowsHookExA
SetWindowLongW
SetWindowLongA
CharNextA
PostThreadMessageW
PostThreadMessageA
PostMessageW
PostMessageA
PeekMessageW
PeekMessageA
LoadStringW
TrackPopupMenuEx
LoadMenuW
LoadMenuA
DestroyMenu
DeleteMenu
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
CreateIconFromResource
LoadIconW
LoadCursorW
LoadAcceleratorsW
LoadAcceleratorsA
IsDialogMessageW
IsDialogMessageA
GetWindowTextLengthW
GetWindowTextLengthA
GetWindowLongW
GetWindowLongA
GetMessageW
GetMessageA
DispatchMessageW
UnregisterClassA
DialogBoxParamW
DialogBoxParamA
DefWindowProcW
DefWindowProcA
CreateDialogParamW
CreateDialogParamA
CopyAcceleratorTableW
CopyAcceleratorTableA
CharUpperBuffW
CharLowerBuffW
CallWindowProcW
CallWindowProcA
IntersectRect
GetMenu
IsMenu
DrawTextA
CloseClipboard
GetClipboardData
OpenClipboard
CheckRadioButton
FindWindowExA
LoadIconA
LoadImageA
LoadCursorA
CallNextHookEx
UnhookWindowsHookEx
CopyRect
SetWindowRgn
SetMenuDefaultItem
SetParent
GetWindowThreadProcessId
InsertMenuA
AppendMenuA
RemoveMenu
GetSubMenu
ModifyMenuA
GetSystemMetrics
DrawIconEx
GetMenuState
GetMenuItemCount
MessageBeep
EnableMenuItem
MsgWaitForMultipleObjects
PostQuitMessage
FrameRect
GetSysColorBrush
SetRect
GetDialogBaseUnits
EndPaint
BeginPaint
ScreenToClient
GetNextDlgTabItem
RegisterWindowMessageA
IsDlgButtonChecked
SetWindowPlacement
BringWindowToTop
SetCursorPos
GetCursorPos
GetDesktopWindow
SetForegroundWindow
GetActiveWindow
EqualRect
InflateRect
SystemParametersInfoA
DestroyIcon
CheckMenuItem
IsChild
GetTopWindow
RedrawWindow
GetDCEx
GetWindowDC
GetWindowPlacement
IsZoomed
IsIconic
GetSystemMenu
GetLastActivePopup
IsWindowEnabled
GetSysColor
EnumChildWindows
DdeUninitialize
DdeFreeStringHandle
DdeNameService
DdeCreateStringHandleA
DdeInitializeA
DdeGetData
DdeQueryStringA
DdeGetLastError
DdeCreateDataHandle
WaitMessage
TranslateMessage
GetFocus
GetWindow
FillRect
EnableWindow
IsWindowVisible
ClientToScreen
PtInRect
OffsetRect
UpdateWindow
GetWindowRect

ole32

CoTaskMemFree
StringFromGUID2
CoLoadLibrary
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
StringFromCLSID
CreateBindCtx
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CoTaskMemRealloc
CLSIDFromProgID
CreateStreamOnHGlobal
OleLockRunning
GetHGlobalFromStream
OleLoadFromStream
WriteClassStm
OleSaveToStream

oleaut32

LoadRegTypeLi
VariantChangeTypeEx
LoadTypeLi
SystemTimeToVariantTime
SysReAllocStringLen
SysReAllocString
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantTimeToSystemTime
SafeArrayGetElement
VariantInit
SysAllocStringLen
SysStringByteLen
VariantChangeType
SysAllocString
VariantClear
SysFreeString
SysStringLen

gdi32

ExtTextOutA
ExtSelectClipRgn
IntersectClipRect
GetTextAlign
CreateRectRgn
CreatePen
MoveToEx
SetTextAlign
GetTextExtentPointW
GetViewportExtEx
GetWindowExtEx
GetTextExtentPointA
GetTextCharsetInfo
TranslateCharsetInfo
GetCurrentObject
GetCharWidthW
CreateSolidBrush
CreateDIBSection
GetDIBits
GetDIBColorTable
SetDIBColorTable
GetNearestPaletteIndex
CreateFontW
CreateFontA
GetTextExtentPoint32W
ExtTextOutW
SetViewportOrgEx
DeleteObject
SetTextColor
SetBkMode
SelectObject
GetDeviceCaps
StretchBlt
GetStockObject
CreateCompatibleDC
SelectPalette
RealizePalette
BitBlt
DeleteDC
CreateCompatibleBitmap
PatBlt
SetStretchBltMode
GetViewportOrgEx
GdiFlush
CreatePolygonRgn
Polygon
GetTextColor
SetBkColor
SaveDC
RestoreDC
CreateFontIndirectA
GetTextExtentPoint32A
GetPaletteEntries
CreateFontIndirectW
GetObjectA
GetObjectW
GetTextMetricsA
GetTextMetricsW
GetClipRgn
GetCharWidthA

kernel32

InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
DebugBreak
RtlUnwind
GetComputerNameW
GlobalUnlock
VirtualFree
VirtualAlloc
SetFileTime
TerminateProcess
ExitProcess
RaiseException
FlushInstructionCache
VirtualProtect
IsValidCodePage
GetExitCodeProcess
GetAtomNameA
FlushFileBuffers
GetProcessTimes
GetVersionExW
IsDBCSLeadByte
GetDateFormatW
GetDateFormatA
GetTimeFormatW
GetTimeFormatA
SetErrorMode
CreateProcessW
CreateProcessA
GetPrivateProfileStringW
WritePrivateProfileStringW
WritePrivateProfileStringA
LoadLibraryW
CreateSemaphoreW
CreateSemaphoreA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
CreateMutexW
CreateMutexA
SetCurrentDirectoryW
SetCurrentDirectoryA
RemoveDirectoryW
RemoveDirectoryA
OutputDebugStringW
OutputDebugStringA
OpenEventW
OpenEventA
MoveFileW
MoveFileA
CopyFileW
CopyFileA
CompareStringW
CompareStringA
LoadLibraryExW
LoadLibraryExA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetTempPathW
GetTempPathA
GetTempFileNameW
GetTempFileNameA
GetPrivateProfileIntW
GetFullPathNameW
GetFullPathNameA
SetFileAttributesW
SetFileAttributesA
GetModuleHandleW
SearchPathW
SearchPathA
GetSystemDirectoryW
GetSystemDirectoryA
GetModuleFileNameW
GetLocaleInfoW
GetLocaleInfoA
GetFileAttributesW
FormatMessageW
FormatMessageA
FindResourceW
FindFirstFileW
FindFirstFileA
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
CreateEventW
CreateEventA
CreateDirectoryW
CreateDirectoryA
IsBadStringPtrW
FindResourceA
LockResource
FindNextFileW
FindNextFileA
FlushViewOfFile
SetFilePointer
SetEndOfFile
MapViewOfFile
UnmapViewOfFile
GetUserDefaultLangID
GetACP
ReadFile
WriteFile
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetThreadPriority
Sleep
CreateFileMappingW
CreateFileMappingA
GetFileAttributesA
SystemTimeToFileTime
SetLastError
FileTimeToSystemTime
GetDiskFreeSpaceA
WaitForMultipleObjects
GlobalDeleteAtom
GlobalAddAtomA
GlobalFree
GlobalLock
GlobalReAlloc
GlobalAlloc
LocalLock
ReleaseSemaphore
TerminateThread
SetThreadPriority
CreateThread
MulDiv
GetTimeZoneInformation
GetSystemDefaultLCID
GetDriveTypeA
GetLogicalDrives
GlobalMemoryStatus
GetSystemInfo
DisableThreadLibraryCalls
TlsFree
TlsAlloc
GetUserDefaultLCID
FreeResource
SizeofResource
LoadResource
ResetEvent
OpenProcess
CreateToolhelp32Snapshot
GetCurrentProcessId
GetStartupInfoA
GetSystemTime
CompareFileTime
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
GetModuleHandleA
lstrcmpiA
GetCurrentThreadId
IsBadCodePtr
IsBadReadPtr
GetPrivateProfileStringA
FindClose
GetFileTime
GetSystemTimeAsFileTime
GetCurrentProcess
FileTimeToLocalFileTime
lstrcmpA
GetFileSize
LoadLibraryA
GetVersionExA
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetPrivateProfileIntA
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
lstrcpynA
GetModuleFileNameA
SetEvent
CloseHandle
InterlockedExchange
WaitForSingleObject
GetTickCount
TlsGetValue
TlsSetValue
GetLastError
IsBadWritePtr
LocalReAlloc
LocalAlloc
LocalFree
FreeLibrary
GetProcAddress
lstrlenW
LeaveCriticalSection
SetUnhandledExceptionFilter

comctl32

PropertySheetW
InitCommonControlsEx
_TrackMouseEvent

imm32

ImmAssociateContext

crypt32

CryptDecodeObject
CryptMsgGetParam

Exports

Exports

?Cleanup@CMarsSignin@@SGXXZ
?ConfigLogonMgrForPoptimize@CSignupConfig@@SGJPAUILogonManager@@@Z
?ConfigLogonMgrForSignup@CSignupConfig@@SGJPAUILogonManager@@@Z
?CreateNewUser@CUserManager@@QAEJPBG0HPAPAVCUser@@@Z
?FindUser@CUserManager@@QAEJPBGPAPAVCUser@@@Z
?GetInstance@CUserManager@@SGJPAPAV1@@Z
?GetLogonManager@CMarsSignin@@SGJPAPAUILogonManager@@@Z
?GetLogonWindow@CApplication@@QAEXPAPAVCLogonWindow@@@Z
?GetMarsWindow@CApplication@@QAEXPAPAVCMarsWindow@@@Z
?Initialize@CMarsSignin@@SGJPAX@Z
?LogIn@CLogonWindow@@QAEJPBG0HH@Z
?Login@CUserManager@@QAEJPAVCUser@@H@Z
?MigrateTapiSettings@CSignupConfig@@SGJPAUIModem@@@Z
?Search@CSearchInput@@QAEJXZ
?SetDelayLoadHook@@YGXP6GP6GHXZIPAUDelayLoadInfo@@@Z@Z
?SetInputText@CSearchInput@@QAEXPBG@Z
?ShowDialog@CMsgBox@@SGHJPBG0KPAG1@Z
?ShowDialog@CMsgBox@@SGHPAUHWND__@@JPBG1KPAG21111J@Z
?ShowSigninError@CMarsSignin@@SGHJPAG0K@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_DoPrivacyDlg@16

Sections

.text
Size: 816KB - Virtual size: 813KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f1b88c1678c1d10d0d7781cdbe373997

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

advapi32

user32

ole32

oleaut32

gdi32

kernel32

comctl32

imm32

crypt32

Exports

Exports

Sections

.text Size: 816KB - Virtual size: 813KB

.data Size: 4KB - Virtual size: 21KB

.rsrc Size: 64KB - Virtual size: 61KB

.reloc Size: 56KB - Virtual size: 54KB

.text Size: 112KB - Virtual size: 112KB

.text
Size: 816KB - Virtual size: 813KB

.data
Size: 4KB - Virtual size: 21KB

.rsrc
Size: 64KB - Virtual size: 61KB

.reloc
Size: 56KB - Virtual size: 54KB

.text
Size: 112KB - Virtual size: 112KB