a0d7b873bc6f6b302522c5cddf6608c573b79c775837b687b543cfbed9561537

Sharing

Copy URL

Twitter E-mail

General

Target

a0d7b873bc6f6b302522c5cddf6608c573b79c775837b687b543cfbed9561537
Size

639KB
MD5

cbd28cbd29b02710c8345073bb531233
SHA1

1580c3d46cb20aff3e416ce43d0d1aaf6d364696
SHA256

a0d7b873bc6f6b302522c5cddf6608c573b79c775837b687b543cfbed9561537
SHA512

63af8cfd95d27eca0258d15c84e71a5fd570cfda2f6fdc5bff960e18584bb04a56b26e2e5ffacb43cb4fc9dc195dbd3d49e44ae2b6a3636c4a4189cfa3a3e4d1
SSDEEP

12288:tKBr4pP1HN21HO04ggGKBr4pP1HN2SKBr4pP1HN21:tI+P1H6HOrgbI+P1HhI+P1HE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0d7b873bc6f6b302522c5cddf6608c573b79c775837b687b543cfbed9561537

Files

a0d7b873bc6f6b302522c5cddf6608c573b79c775837b687b543cfbed9561537
.dll windows:6 windows x86 arch:x86

14d3646ee370dfa4eb23291a72116ff9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\bt\942905\client\wld\setup\bldsetup\mail\lmcustom\obj\i386\lmcustom.pdb

Imports

kernel32

Sleep
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenEventW
TerminateProcess
MulDiv
GetExitCodeProcess
CreateProcessW
GetNativeSystemInfo
WideCharToMultiByte
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
DeleteFileW
ExitThread
CreateThread
GetCPInfo
RemoveDirectoryW
CreateDirectoryW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetVersionExW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
GetLocaleInfoW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
OpenMutexW
CreateEventW
GetLastError
ExpandEnvironmentStringsW
ResetEvent
GetTempPathW
GetTempFileNameW
InterlockedDecrement
SetEvent
CreateFileW
WriteFile
WaitForSingleObject
SetLastError
CloseHandle

user32

EnumWindows
GetWindowThreadProcessId
PostMessageW

shlwapi

PathQuoteSpacesW
StrFormatByteSizeW
UrlCreateFromPathW
PathCombineW
PathAppendW
StrCmpIW
SHDeleteKeyW
SHSetValueW
SHGetValueW
PathRemoveArgsW
StrCmpW
SHDeleteValueW
SHCopyKeyW
PathMatchSpecW

shell32

SHChangeNotify
ShellExecuteW

msi

ord114
ord116
ord119
ord171
ord34
ord8
ord32
ord159
ord160
ord124
ord205
ord70
ord49
ord103
ord74
ord121
ord17
ord125
ord118
ord145

ole32

OleRun
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
GetErrorInfo
VariantCopy
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantChangeType
SysFreeString
SysAllocString

wininet

HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile

crypt32

CertGetCertificateChain
CertFindCertificateInStore
CertVerifyCertificateChainPolicy
CryptQueryObject
CertGetNameStringW
CertFreeCertificateChain
CertFreeCertificateContext
CryptMsgGetParam
CertCloseStore
CryptMsgClose

wintrust

WinVerifyTrust

setupapi

SetupIterateCabinetW

advapi32

OpenServiceW
CloseServiceHandle
ControlService
OpenSCManagerW

Exports

Exports

AddExpectedTicks
BackupFileAssociations
CheckMailRunning
EnsureOptedIn
FindRelatedProductsJr
GetAUValues
OESPADDisable
OESPADEnable
RegisterClient
RenameHotmailDefaultMailClientIfNecessary
RevertFileAssociations
SetAUValues
SetAUValuesDeferred
ShutdownDesktopSearch
ShutdownWLMd
UnregisterClient

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14d3646ee370dfa4eb23291a72116ff9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

shell32

msi

ole32

oleaut32

wininet

crypt32

wintrust

setupapi

advapi32

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

.data Size: 5KB - Virtual size: 13KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 165KB - Virtual size: 164KB

.data
Size: 5KB - Virtual size: 13KB

.reloc
Size: 10KB - Virtual size: 9KB