9ee870f363b0c3d1703f347dd98bc2d102df0d7cd7b450376fb561cea3b5a916

Sharing

Copy URL Twitter E-mail

General

Target

9ee870f363b0c3d1703f347dd98bc2d102df0d7cd7b450376fb561cea3b5a916
Size

276KB
MD5

edaff44ac5242188d427755d2b2aff94
SHA1

5b0952a781428cf5bc597aa9865e742d1142ea60
SHA256

9ee870f363b0c3d1703f347dd98bc2d102df0d7cd7b450376fb561cea3b5a916
SHA512

8e48b066a8a73d40187ce5c9a90f019ae32a4d28974a30a10f9e3404b58bd83cdf8115a39b56492b5e64842bb710473781eb47d4f3c25db3e46366a0aa5d568f
SSDEEP

3072:fPUfO6+L40Bp5qQTnM5ySrvDUCiWM/vjUmjQwGR8/RxIJvUueMRMv5p3:fPd6+c0BDKTrvgCGv1ja8/RxqIj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ee870f363b0c3d1703f347dd98bc2d102df0d7cd7b450376fb561cea3b5a916

Files

9ee870f363b0c3d1703f347dd98bc2d102df0d7cd7b450376fb561cea3b5a916
.dll windows:6 windows x86 arch:x86

85038d8c844d77a7dd31a9206cc76d26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\PcVirus\acks\ACKS_2012\ACKS_2012\Debug\shellengine.pdb

Imports

ws2_32

send
WSAGetLastError
connect
socket
WSAStartup
closesocket
getaddrinfo
freeaddrinfo
recv

wininet

InternetConnectA
InternetCloseHandle
InternetOpenA
InternetWriteFile
InternetQueryDataAvailable
InternetSetOptionExA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestExA
HttpEndRequestA
HttpQueryInfoA
InternetReadFile

shlwapi

PathFindFileNameW

kernel32

GetLocaleInfoEx
GetStringTypeW
VirtualQuery
HeapReAlloc
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitOnceExecuteOnce
GetFileType
CreateFileA
CreateFileW
DeleteFileA
FindFirstFileW
FindNextFileW
GetFileSize
GetFileSizeEx
ReadFile
SetFilePointerEx
WriteFile
CloseHandle
SetHandleInformation
GetLastError
CreatePipe
PeekNamedPipe
WaitForSingleObject
Sleep
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetExitCodeThread
CreateProcessA
GetTimeFormatEx
LocalFree
GetVersionExA
HeapSize
FindClose
GetLogicalDrives
GetEnvironmentVariableA
OutputDebugStringA
DeviceIoControl
OpenThread
SuspendThread
GetTickCount
GetModuleFileNameA
GetShortPathNameA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
CreateDirectoryW
FatalAppExitA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetStdHandle
GetProcessHeap
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
LoadLibraryW
lstrlenA
GetCurrentThread
InterlockedIncrement
GetDateFormatEx
CompareStringEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
OutputDebugStringW
GetLocalTime
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleW
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
GetStartupInfoW
SetStdHandle
GetFileAttributesA
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetCommandLineA
MultiByteToWideChar
AreFileApisANSI
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
ExitThread
ResumeThread
EncodePointer
DecodePointer
GetProcAddress
LoadLibraryExW
HeapFree
HeapAlloc
RtlUnwind
InterlockedDecrement
ExitProcess
GetModuleHandleExW

user32

ReleaseDC
GetDC
IsWindowVisible
GetWindowLongA
SetWindowLongA
GetTopWindow
GetWindow
SendInput
PrintWindow
GetWindowRect
GetWindowTextA
EnumDisplayMonitors
GetMonitorInfoA
EnumDisplaySettingsA
PtInRect
GetCursorPos
SetCursorPos
GetSystemMetrics

gdi32

SelectObject
GetCurrentObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
StretchBlt

advapi32

GetUserNameA

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CreateStreamOnHGlobal

crypt32

CryptUnprotectData

gdiplus

GdipCloneImage
GdipGetImageEncoders
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize

Exports

Exports

SEEnd
SEStart

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85038d8c844d77a7dd31a9206cc76d26

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wininet

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

crypt32

gdiplus

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 5KB - Virtual size: 36KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 5KB - Virtual size: 36KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 9KB