c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d

Sharing

Copy URL Twitter E-mail

General

Target

c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d
Size

1.4MB
MD5

a2104a61be3d5f6c5339e768fe2e71a6
SHA1

2cecadd0beb26461c3806b5d27efbabe4f173821
SHA256

c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d
SHA512

ad89fbf42ddaa72801dcc9b62c02e8c17ba65a52de9bba807d33f895b43b6ffb9fb1e1a12bc1db56d2a840cadc75a8b1639b309638006d6d48b34ec527d38a49
SSDEEP

24576:NZ9aFrc7eKFV5ts1gjdV0GM2RVQ+c9ZTb2EYok:NZwrc7e2+1gjAGDQ5LTb2L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d

Files

c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d
.dll windows:6 windows x64 arch:x64

fb53c25042d49980f86f221ccb7bb886

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

select
setsockopt
WSAStartup
gethostbyname
getprotobyname
ioctlsocket
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
inet_addr
WSAIoctl
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
accept
listen
gethostname
socket
WSAEventSelect
getsockopt
connect
send
recv
WSAGetLastError
ntohs
htons
getsockname
closesocket
bind
shutdown
freeaddrinfo
getaddrinfo
WSACleanup

wininet

InternetSetOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetReadFile

gdiplus

GdiplusShutdown
GdipSaveImageToStream
GdipFree
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipBitmapSetResolution
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipGraphicsClear
GdipGetImageVerticalResolution
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdipGetImageEncoders
GdipSetInterpolationMode
GdipCloneImage
GdiplusStartup
GdipGetImageWidth
GdipCreateBitmapFromHBITMAP

rpcrt4

RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
NdrAsyncClientCall
RpcRaiseException
RpcAsyncCompleteCall
RpcBindingFree
RpcStringFreeW

kernel32

WaitForDebugEvent
InitializeProcThreadAttributeList
SetFilePointer
SetFilePointerEx
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreatePipe
ReadFile
TerminateProcess
WriteFile
WaitForSingleObject
SetHandleInformation
PeekNamedPipe
GetCurrentThreadId
WriteProcessMemory
OpenProcess
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
CloseHandle
CreateFileW
GlobalUnlock
GetProcessHeap
GetModuleHandleW
GlobalLock
HeapFree
HeapAlloc
DeleteFileW
GetTempPathW
GetCurrentDirectoryW
GetLastError
CopyFileW
MoveFileExW
CreateThread
GetCurrentProcessId
VirtualProtect
GetModuleHandleA
GetModuleFileNameA
SetCurrentDirectoryW
VirtualAlloc
ExitThread
GetEnvironmentVariableA
GetTimeZoneInformation
GetModuleFileNameW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
Sleep
GetSystemDirectoryW
VirtualFree
GetCurrentProcess
SetErrorMode
GetCommandLineW
ExitProcess
GetThreadContext
SetThreadContext
Thread32First
HeapCreate
Thread32Next
SetThreadPriority
OpenThread
GetThreadPriority
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
UnlockFile
LockFile
FormatMessageW
FindNextFileA
FindFirstFileA
InitializeCriticalSection
QueryPerformanceFrequency
SetEnvironmentVariableA
SetEndOfFile
WriteConsoleW
GetFullPathNameW
GetFileInformationByHandle
FileTimeToLocalFileTime
OutputDebugStringW
SetStdHandle
GetConsoleCP
FlushFileBuffers
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
ReadConsoleW
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStdHandle
HeapSize
AreFileApisANSI
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
LoadLibraryExW
GetCPInfo
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetStringTypeW
SetNamedPipeHandleState
CancelIoEx
DisconnectNamedPipe
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
CreateEventW
GetSystemTime
FreeLibrary
ResumeThread
SuspendThread
GetExitCodeThread
TerminateThread
CreateProcessW
GlobalFree
GetTickCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LockFileEx
GetDiskFreeSpaceW
CreateFileMappingW
GetFileAttributesExW
ContinueDebugEvent
GetVolumeInformationW
GetDiskFreeSpaceExW
GetFileTime
FindNextFileW
Process32NextW
RemoveDirectoryW
GetFileType
GetCurrentThread
LocalAlloc
LocalFree
GetTickCount64
GetModuleHandleExW
Module32FirstW
CreateToolhelp32Snapshot
Module32NextW
LoadLibraryA
DuplicateHandle
IsBadReadPtr
SetEvent
WaitForMultipleObjects
OpenEventW
WideCharToMultiByte
MultiByteToWideChar
OpenMutexA
CreateMutexA
GetEnvironmentVariableW
GetFileSize
GetUserDefaultLocaleName
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
VirtualQuery
K32GetProcessImageFileNameW
GetLogicalDriveStringsW
SetEnvironmentVariableW
CreateDirectoryW
GetComputerNameW
GetFileAttributesW
GetPhysicallyInstalledSystemMemory
GetFileSizeEx
FindClose
Process32FirstW
GetProcessId
IsWow64Process

user32

MapVirtualKeyW
SetTimer
GetMessageW
GetRawInputData
UnregisterClassW
TranslateMessage
wsprintfW
EnumDisplayMonitors
SetProcessWindowStation
SetProcessDPIAware
GetThreadDesktop
GetKeyboardState
GetForegroundWindow
EnumWindows
GetClassNameW
IsWindowVisible
RegisterClassExW
GetClipboardData
GetWindowTextW
RegisterRawInputDevices
CreateWindowExW
OpenClipboard
CloseWindow
ToUnicode
DefWindowProcW
GetWindowThreadProcessId
DispatchMessageW
MonitorFromWindow
CloseWindowStation
GetProcessWindowStation
OpenInputDesktop
CloseDesktop
GetDC
OpenWindowStationA
ReleaseDC
CloseClipboard
GetDesktopWindow
SetThreadDesktop
KillTimer

gdi32

DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
BitBlt

advapi32

DuplicateToken
RegUnLoadKeyW
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
OpenServiceW
GetTokenInformation
LookupPrivilegeValueW
StartServiceW
DuplicateTokenEx
QueryServiceStatusEx
IsValidSid
ConvertSidToStringSidW
QueryServiceStatus
CreateProcessAsUserW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthority
IsWellKnownSid
RegSetValueExW
RegCloseKey
RegLoadKeyW
RegOpenKeyExW
GetUserNameW
SetThreadToken
InitializeSecurityDescriptor
PrivilegeCheck
ConvertStringSidToSidW
CreateProcessWithTokenW
SetSecurityDescriptorDacl
LookupAccountSidW
CheckTokenMembership
AdjustTokenPrivileges
CreateWellKnownSid
RegDeleteKeyExW
RegEnumKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteValueW

ole32

CoGetObject
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
VariantInit
VariantClear

ntdll

NtRemoveProcessDebug
NtQueryObject
NtQueryInformationToken
NtClose
NtDuplicateObject
DbgUiSetThreadDebugObject
NtReadVirtualMemory
RtlAddFunctionTable
NtQueryInformationProcess
RtlCreateUnicodeString

dbghelp

MiniDumpWriteDump

shlwapi

ord176

bcrypt

BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptSetProperty
BCryptOpenAlgorithmProvider

imagehlp

CheckSumMappedFile

winhttp

WinHttpGetProxyForUrl
WinHttpConnect
WinHttpOpen
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReadData
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

iphlpapi

GetIpForwardTable
GetAdaptersAddresses

Exports

Exports

unqlite_begin
unqlite_close
unqlite_commit
unqlite_config
unqlite_kv_append
unqlite_kv_append_fmt
unqlite_kv_config
unqlite_kv_cursor_data
unqlite_kv_cursor_data_callback
unqlite_kv_cursor_delete_entry
unqlite_kv_cursor_first_entry
unqlite_kv_cursor_init
unqlite_kv_cursor_key
unqlite_kv_cursor_key_callback
unqlite_kv_cursor_last_entry
unqlite_kv_cursor_next_entry
unqlite_kv_cursor_prev_entry
unqlite_kv_cursor_release
unqlite_kv_cursor_reset
unqlite_kv_cursor_seek
unqlite_kv_cursor_valid_entry
unqlite_kv_delete
unqlite_kv_fetch
unqlite_kv_fetch_callback
unqlite_kv_store
unqlite_kv_store_fmt
unqlite_lib_config
unqlite_lib_copyright
unqlite_lib_ident
unqlite_lib_init
unqlite_lib_is_threadsafe
unqlite_lib_shutdown
unqlite_lib_signature
unqlite_lib_version
unqlite_open
unqlite_rollback
unqlite_util_random_num
unqlite_util_random_string

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb53c25042d49980f86f221ccb7bb886

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

gdiplus

rpcrt4

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ntdll

dbghelp

shlwapi

bcrypt

imagehlp

winhttp

netapi32

iphlpapi

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 318KB - Virtual size: 317KB

.data Size: 42KB - Virtual size: 59KB

.pdata Size: 65KB - Virtual size: 65KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 318KB - Virtual size: 317KB

.data
Size: 42KB - Virtual size: 59KB

.pdata
Size: 65KB - Virtual size: 65KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 4KB