fb99219d4a89893e53163fbb66e06bfc6d6e6debdca96407986187c3cf9bbd96

Sharing

Copy URL

Twitter E-mail

General

Target

fb99219d4a89893e53163fbb66e06bfc6d6e6debdca96407986187c3cf9bbd96
Size

383KB
MD5

31c42fb4112938a982b020cf02f27ae3
SHA1

23977b74b9bf5ba0167261cb35e82836a3ae468a
SHA256

fb99219d4a89893e53163fbb66e06bfc6d6e6debdca96407986187c3cf9bbd96
SHA512

784297c71cd69ae0e3d6b5cafe13723ce684aefc1c8224162dc02c9ff79748b1e4f4e422284272c729fffb235745501c720b3964f75bd282e7a8bb8da80a00dc
SSDEEP

3072:WQ5rZl9sWIURLo5jKkT4a94GL13mTeyqp8ZH+Kkzqys:WQ5rZl9bIURLolKGgTE8ZfkX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb99219d4a89893e53163fbb66e06bfc6d6e6debdca96407986187c3cf9bbd96

Files

fb99219d4a89893e53163fbb66e06bfc6d6e6debdca96407986187c3cf9bbd96
.dll windows:10 windows x64 arch:x64

3df6efe26236bc1b0d866e5bcceeb49c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wevtapi.pdb

Imports

msvcp_win

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcstoui64
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_free
_o_iswalnum
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_strncpy_s
_o_terminate
_o_toupper
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcsnlen
wcscmp
memset
strnlen

ntdll

EtwGetTraceEnableFlags
RtlCaptureContext
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwTraceMessage
RtlLookupFunctionEntry
RtlSetLastWin32Error
RtlNtStatusToDosError
NtSetInformationFile
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlComputeCrc32
NtWriteFile
NtReadFile
EtwUnregisterTraceGuids
RtlVirtualUnwind

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-synch-l1-1-0

ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
CreateMutexExW
CreateSemaphoreExW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObjectEx
ReleaseSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
OpenSemaphoreW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
GetThreadUILanguage
GetLocaleInfoW

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

ReadFile
FlushFileBuffers
GetFileAttributesW
GetFullPathNameW
SetFilePointerEx
GetTempFileNameW
GetFileSizeEx
GetDiskFreeSpaceExW
SetEndOfFile
DeleteFileW
GetFileInformationByHandle
CreateFileW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TlsAlloc
TlsFree
TerminateProcess
TlsSetValue
TlsGetValue
GetCurrentProcess

api-ms-win-security-base-l1-1-0

IsValidSid
GetLengthSid

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroup
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CreateThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleFileNameA

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EvtArchiveExportedLog
EvtCancel
EvtClearLog
EvtClose
EvtCreateBookmark
EvtCreateRenderContext
EvtExportLog
EvtFormatMessage
EvtGetChannelConfigProperty
EvtGetEventInfo
EvtGetEventMetadataProperty
EvtGetExtendedStatus
EvtGetLogInfo
EvtGetObjectArrayProperty
EvtGetObjectArraySize
EvtGetPublisherMetadataProperty
EvtGetQueryInfo
EvtIntAssertConfig
EvtIntCreateBinXMLFromCustomXML
EvtIntCreateLocalLogfile
EvtIntGetClassicLogDisplayName
EvtIntRenderResourceEventTemplate
EvtIntReportAuthzEventAndSourceAsync
EvtIntReportEventAndSourceAsync
EvtIntRetractConfig
EvtIntSysprepCleanup
EvtIntWriteXmlEventToLocalLogfile
EvtNext
EvtNextChannelPath
EvtNextEventMetadata
EvtNextPublisherId
EvtOpenChannelConfig
EvtOpenChannelEnum
EvtOpenEventMetadataEnum
EvtOpenLog
EvtOpenPublisherEnum
EvtOpenPublisherMetadata
EvtOpenSession
EvtQuery
EvtRender
EvtSaveChannelConfig
EvtSeek
EvtSetChannelConfigProperty
EvtSubscribe
EvtUpdateBookmark

Sections

.text
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3df6efe26236bc1b0d866e5bcceeb49c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 290KB - Virtual size: 289KB

.rdata Size: 67KB - Virtual size: 67KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 15KB - Virtual size: 14KB

.didat Size: 512B - Virtual size: 200B

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 290KB - Virtual size: 289KB

.rdata
Size: 67KB - Virtual size: 67KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 15KB - Virtual size: 14KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1KB - Virtual size: 1KB