1d0191c5dc6cd12bc3718fbc1c7bff5dc037d79f6e0aa29441a9d2c717a81005

Sharing

Copy URL Twitter E-mail

General

Target

1d0191c5dc6cd12bc3718fbc1c7bff5dc037d79f6e0aa29441a9d2c717a81005
Size

1.6MB
MD5

3ff80832909ed1632831ebebe3e792c1
SHA1

9e7d17baf148c2d9267db94346b0a50551726034
SHA256

1d0191c5dc6cd12bc3718fbc1c7bff5dc037d79f6e0aa29441a9d2c717a81005
SHA512

e89b5a066c97471e705b584c0c5456cdad29d28994a8060a1cf99f8f55fc316a38030cb507336f7d2009626286e2eaa3bb0b179af1c0843707f425bd23e081c4
SSDEEP

24576:MsroxhWmqvuNYs9pLplStBThAmDM7tDAJCB6vzJuSK:RECmqWNtpgtBrwt0O6vzJu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d0191c5dc6cd12bc3718fbc1c7bff5dc037d79f6e0aa29441a9d2c717a81005

Files

1d0191c5dc6cd12bc3718fbc1c7bff5dc037d79f6e0aa29441a9d2c717a81005
.dll windows:5 windows x86 arch:x86

dd810217fd321ed61d3e2811624cf289

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscms

GetColorProfileElement

oleaut32

GetRecordInfoFromTypeInfo

user32

GetComboBoxInfo
GetClassLongA
IsWindow
GetClientRect
DrawTextA
GetDlgItemTextA
LoadAcceleratorsW
GetMenuCheckMarkDimensions
LoadIconA
GetCaretPos
FreeDDElParam
GetWindowPlacement
IsWinEventHookInstalled
LoadIconW
FindWindowExA
FindWindowExW
MessageBoxIndirectW
GetCapture
GetTopWindow
GetThreadDesktop
LoadCursorW
GetClipboardFormatNameW
GetClipCursor
GetProcessWindowStation

gdi32

GetBrushOrgEx
GetPolyFillMode
GetBitmapBits
GetFontUnicodeRanges
DeleteEnhMetaFile
GetCharWidthA
EqualRgn
FillRgn
GetRasterizerCaps
GetTextExtentPoint32A
GetTextExtentPointA
GetTextColor
GetRandomRgn
GetLayout
GetTextMetricsW

comdlg32

GetOpenFileNameW
GetSaveFileNameA

shell32

ExtractAssociatedIconExW
ExtractIconW

msvcrt

fseek
strncmp
ungetwc
vprintf
strtod
ftell
strftime
strlen

winspool.drv

DeletePrinterDriverW
GetPrinterDriverDirectoryW

ole32

GetConvertStg
GetClassFile

advapi32

LookupAccountNameA
GetServiceKeyNameA
GetOldestEventLogRecord
GetUserNameA
GetTokenInformation
GetWindowsAccountDomainSid
GetLengthSid
IsValidSecurityDescriptor
EqualSid
LockServiceDatabase
GetSidSubAuthorityCount
LogonUserA

wininet

GetUrlCacheEntryInfoExA

clusapi

GetClusterResourceNetworkName

ws2_32

shutdown

kernel32

GetLongPathNameA
FindResourceA
GetCPInfo
GetProcessTimes
GetCommState
GetCurrentProcess
GetUserDefaultUILanguage
GenerateConsoleCtrlEvent
GetTapeParameters
lstrcatW
GetFileAttributesA
GetPrivateProfileStringW
GetDriveTypeA
GlobalAlloc
GetLocaleInfoW
GetStringTypeA
GetTempFileNameW
GetWindowsDirectoryW
GetProcessAffinityMask
VirtualAlloc
IsValidLocale
DeleteTimerQueue
GetSystemPowerStatus
GetThreadTimes
GetVolumePathNamesForVolumeNameW
GetPrivateProfileIntW
VirtualQueryEx
GetTempPathA
EscapeCommFunction
GetCommMask
FlushFileBuffers
DeleteFiber
GetPrivateProfileStringA
GetCompressedFileSizeW
lstrlenW
Module32Next
GetTimeFormatW
GetStringTypeW
LocalFileTimeToFileTime
FillConsoleOutputAttribute
GetModuleHandleA
GetModuleFileNameA
GetBinaryTypeA
Module32FirstW
FileTimeToSystemTime
GetPrivateProfileSectionA
ExpandEnvironmentStringsA
FindNextVolumeW
EnumTimeFormatsA
WritePrivateProfileStructA
FindActCtxSectionGuid
WriteProfileStringW
GetFileSize
LoadLibraryExA

urlmon

MkParseDisplayNameEx
IsValidURL
GetClassFileOrMime

powrprof

IsPwrHibernateAllowed

Sections

.text
Size: 692KB - Virtual size: 689KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 892KB - Virtual size: 888KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd810217fd321ed61d3e2811624cf289

Headers

DLL Characteristics

File Characteristics

Imports

mscms

oleaut32

user32

gdi32

comdlg32

shell32

msvcrt

winspool.drv

ole32

advapi32

wininet

clusapi

ws2_32

kernel32

urlmon

powrprof

Sections

.text Size: 692KB - Virtual size: 689KB

.rdata Size: 892KB - Virtual size: 888KB

.data Size: 76KB - Virtual size: 80KB

.idata Size: 8KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 692KB - Virtual size: 689KB

.rdata
Size: 892KB - Virtual size: 888KB

.data
Size: 76KB - Virtual size: 80KB

.idata
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB