2071279be2f6c9ef1777afc6305c4c27a5a5e57b6560daafbff3033c002fb01d

Sharing

Copy URL Twitter E-mail

General

Target

2071279be2f6c9ef1777afc6305c4c27a5a5e57b6560daafbff3033c002fb01d
Size

231KB
MD5

c5cf7eeda09c88ce5415cf8ff9af9846
SHA1

2deb9378cf16212320d72359d52b0643611a5455
SHA256

2071279be2f6c9ef1777afc6305c4c27a5a5e57b6560daafbff3033c002fb01d
SHA512

35a8f4bd99d82268c8277ca8373ade71eb279a35e1e2f564319ba8bc0c9aac2ffefb49dc4ccad2bb465371d86fe783aedc1354df40d978ddc58605610350ec7a
SSDEEP

3072:42wK7FHoQGd4lVl0yb5Wj5YiQZHjAa3vtzWK44oh6Q4TANvo24NOV9VgzM1YA+Yg:4ydGtyptjthWr4or1A2pV9z19b8sgp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2071279be2f6c9ef1777afc6305c4c27a5a5e57b6560daafbff3033c002fb01d

Files

2071279be2f6c9ef1777afc6305c4c27a5a5e57b6560daafbff3033c002fb01d
.dll regsvr32 windows:6 windows x86 arch:x86

dd383a5d01057d7e13e8b77454595bd4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
FormatMessageA
GetModuleFileNameA
HeapFree
lstrcmpA
Sleep
GetModuleHandleExA
FormatMessageW
SetEvent
LoadLibraryA
GlobalAlloc
GetLastError
CloseHandle
LoadLibraryW
HeapAlloc
GetProcAddress
LocalFree
ExitProcess
GetProcessHeap
WideCharToMultiByte
CreateEventA
CreateFileW
DecodePointer
MultiByteToWideChar
GetModuleHandleA
lstrlenA
GlobalFree
lstrlenW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
GetStringTypeW
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSemaphore
OpenEventA
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

user32

wsprintfW

advapi32

RegQueryInfoKeyW
RegQueryValueExA
RegOpenKeyExA
RegEnumValueW
RegCloseKey

shell32

ShellExecuteA

ole32

CLSIDFromProgID
CoCreateInstance
CoInitialize

winhttp

WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData

Exports

Exports

ClearPropVariantArray
ClearVariantArray
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
InitPropVariantFromBooleanVector
InitPropVariantFromBuffer
InitPropVariantFromCLSID
InitPropVariantFromDoubleVector
InitPropVariantFromFileTime
InitPropVariantFromFileTimeVector
InitPropVariantFromGUIDAsString
InitPropVariantFromInt16Vector
InitPropVariantFromInt32Vector
InitPropVariantFromInt64Vector
InitPropVariantFromPropVariantVectorElem
InitPropVariantFromResource
InitPropVariantFromStrRet
InitPropVariantFromStringAsVector
InitPropVariantFromStringVector
InitPropVariantFromUInt16Vector
InitPropVariantFromUInt32Vector
InitPropVariantFromUInt64Vector
InitPropVariantVectorFromPropVariant
InitVariantFromBooleanArray
InitVariantFromBuffer
InitVariantFromDoubleArray
InitVariantFromFileTime
InitVariantFromFileTimeArray
InitVariantFromGUIDAsString
InitVariantFromInt16Array
InitVariantFromInt32Array
InitVariantFromInt64Array
InitVariantFromResource
InitVariantFromStrRet
InitVariantFromStringArray
InitVariantFromUInt16Array
InitVariantFromUInt32Array
InitVariantFromUInt64Array
InitVariantFromVariantArrayElem
LogErrorA
LogErrorW
LogEventA
LogEventW
MprSetupProtocolEnum
MprSetupProtocolFree
PSCoerceToCanonicalValue
PSCreateAdapterFromPropertyStore
PSCreateDelayedMultiplexPropertyStore
PSCreateMemoryPropertyStore
PSCreateMultiplexPropertyStore
PSCreatePropertyChangeArray
PSCreatePropertyStoreFromObject
PSCreatePropertyStoreFromPropertySetStorage
PSCreateSimplePropertyChange
PSEnumeratePropertyDescriptions
PSFormatForDisplay
PSFormatForDisplayAlloc
PSFormatPropertyValue
PSGetImageReferenceForValue
PSGetItemPropertyHandler
PSGetItemPropertyHandlerWithCreateObject
PSGetNameFromPropertyKey
PSGetNamedPropertyFromPropertyStorage
PSGetPropertyDescription
PSGetPropertyDescriptionByName
PSGetPropertyDescriptionListFromString
PSGetPropertyFromPropertyStorage
PSGetPropertyKeyFromName
PSGetPropertySystem
PSGetPropertyValue
PSLookupPropertyHandlerCLSID
PSPropertyBag_Delete
PSPropertyBag_ReadBOOL
PSPropertyBag_ReadBSTR
PSPropertyBag_ReadDWORD
PSPropertyBag_ReadGUID
PSPropertyBag_ReadInt
PSPropertyBag_ReadLONG
PSPropertyBag_ReadPOINTL
PSPropertyBag_ReadPOINTS
PSPropertyBag_ReadPropertyKey
PSPropertyBag_ReadRECTL
PSPropertyBag_ReadSHORT
PSPropertyBag_ReadStr
PSPropertyBag_ReadStrAlloc
PSPropertyBag_ReadStream
PSPropertyBag_ReadType
PSPropertyBag_ReadULONGLONG
PSPropertyBag_ReadUnknown
PSPropertyBag_WriteBOOL
PSPropertyBag_WriteBSTR
PSPropertyBag_WriteDWORD
PSPropertyBag_WriteGUID
PSPropertyBag_WriteInt
PSPropertyBag_WriteLONG
PSPropertyBag_WritePOINTL
PSPropertyBag_WritePOINTS
PSPropertyBag_WritePropertyKey
PSPropertyBag_WriteRECTL
PSPropertyBag_WriteSHORT
PSPropertyBag_WriteStr
PSPropertyBag_WriteStream
PSPropertyBag_WriteULONGLONG
PSPropertyBag_WriteUnknown
PSPropertyKeyFromString
PSRefreshPropertySchema
PSRegisterPropertySchema
PSSetPropertyValue
PSStringFromPropertyKey
PSUnregisterPropertySchema
PropVariantChangeType
PropVariantCompareEx
PropVariantGetBooleanElem
PropVariantGetDoubleElem
PropVariantGetElementCount
PropVariantGetFileTimeElem
PropVariantGetInt16Elem
PropVariantGetInt32Elem
PropVariantGetInt64Elem
PropVariantGetStringElem
PropVariantGetUInt16Elem
PropVariantGetUInt32Elem
PropVariantGetUInt64Elem
PropVariantToBSTR
PropVariantToBoolean
PropVariantToBooleanVector
PropVariantToBooleanVectorAlloc
PropVariantToBooleanWithDefault
PropVariantToBuffer
PropVariantToDouble
PropVariantToDoubleVector
PropVariantToDoubleVectorAlloc
PropVariantToDoubleWithDefault
PropVariantToFileTime
PropVariantToFileTimeVector
PropVariantToFileTimeVectorAlloc
PropVariantToGUID
PropVariantToInt16
PropVariantToInt16Vector
PropVariantToInt16VectorAlloc
PropVariantToInt16WithDefault
PropVariantToInt32
PropVariantToInt32Vector
PropVariantToInt32VectorAlloc
PropVariantToInt32WithDefault
PropVariantToInt64
PropVariantToInt64Vector
PropVariantToInt64VectorAlloc
PropVariantToInt64WithDefault
PropVariantToStrRet
PropVariantToString
PropVariantToStringAlloc
PropVariantToStringVector
PropVariantToStringVectorAlloc
PropVariantToStringWithDefault
PropVariantToUInt16
PropVariantToUInt16Vector
PropVariantToUInt16VectorAlloc
PropVariantToUInt16WithDefault
PropVariantToUInt32
PropVariantToUInt32Vector
PropVariantToUInt32VectorAlloc
PropVariantToUInt32WithDefault
PropVariantToUInt64
PropVariantToUInt64Vector
PropVariantToUInt64VectorAlloc
PropVariantToUInt64WithDefault
PropVariantToVariant
PropVariantToWinRTPropertyValue
RouterAssert
RouterGetErrorStringA
RouterGetErrorStringW
RouterLogDeregisterW
RouterLogEventA
RouterLogEventDataA
RouterLogEventDataW
RouterLogEventExA
RouterLogEventExW
RouterLogEventStringA
RouterLogEventStringW
RouterLogEventValistExA
RouterLogEventValistExW
RouterLogEventW
RouterLogRegisterA
RouterLogRegisterW
StgDeserializePropVariant
StgSerializePropVariant
TraceDeregisterA
TraceDeregisterExA
TraceDeregisterExW
TraceDeregisterW
TraceDumpExA
TraceDumpExW
TraceGetConsoleA
TraceGetConsoleW
TracePrintfA
TracePrintfExA
TracePrintfExW
TracePrintfW
TracePutsExA
TracePutsExW
TraceRegisterExA
TraceRegisterExW
TraceVprintfExA
TraceVprintfExW
VariantCompare
VariantGetBooleanElem
VariantGetDoubleElem
VariantGetElementCount
VariantGetInt16Elem
VariantGetInt32Elem
VariantGetInt64Elem
VariantGetStringElem
VariantGetUInt16Elem
VariantGetUInt32Elem
VariantGetUInt64Elem
VariantToBoolean
VariantToBooleanArray
VariantToBooleanArrayAlloc
VariantToBooleanWithDefault
VariantToBuffer
VariantToDosDateTime
VariantToDouble
VariantToDoubleArray
VariantToDoubleArrayAlloc
VariantToDoubleWithDefault
VariantToFileTime
VariantToGUID
VariantToInt16
VariantToInt16Array
VariantToInt16ArrayAlloc
VariantToInt16WithDefault
VariantToInt32
VariantToInt32Array
VariantToInt32ArrayAlloc
VariantToInt32WithDefault
VariantToInt64
VariantToInt64Array
VariantToInt64ArrayAlloc
VariantToInt64WithDefault
VariantToPropVariant
VariantToStrRet
VariantToString
VariantToStringAlloc
VariantToStringArray
VariantToStringArrayAlloc
VariantToStringWithDefault
VariantToUInt16
VariantToUInt16Array
VariantToUInt16ArrayAlloc
VariantToUInt16WithDefault
VariantToUInt32
VariantToUInt32Array
VariantToUInt32ArrayAlloc
VariantToUInt32WithDefault
VariantToUInt64
VariantToUInt64Array
VariantToUInt64ArrayAlloc
VariantToUInt64WithDefault
WinRTPropertyValueToPropVariant
outerLogDeregisterA

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pwoe
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd383a5d01057d7e13e8b77454595bd4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

winhttp

Exports

Exports

Sections

.text Size: 159KB - Virtual size: 159KB

.pwoe Size: 1KB - Virtual size: 1KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 4KB - Virtual size: 8KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 159KB - Virtual size: 159KB

.pwoe
Size: 1KB - Virtual size: 1KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 4KB - Virtual size: 8KB

.reloc
Size: 9KB - Virtual size: 8KB