e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10

Sharing

Copy URL Twitter E-mail

General

Target

e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10
Size

1.1MB
MD5

05b6f459be513bf6120e9b2b85f6c844
SHA1

56dddfda80d3eb6d6cd3f0531719cf9fac5abf4a
SHA256

e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10
SHA512

ffca469d604fc0e6c3c5ff2c86674f33e9c4b5d4bed297fd9bb7992669ae12bc569f5087bfe9566f397eb7f5f087f477fc028ae5898352c22efeec54bc28f4c8
SSDEEP

24576:m7ppILRKvKboseNnZOIO0MB0wFQCb1d+dER99QEM6ay8U:m3ILRKvnvaIO0MtQCbPso9Qhy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10

Files

e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10
.dll regsvr32 windows:5 windows x64 arch:x64

4c2c167a499f4140e8f92ab4e66832ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpReadData
WinHttpConnect

shlwapi

PathFileExistsW
PathFindFileNameW

kernel32

GlobalLock
GlobalAlloc
SizeofResource
GlobalFree
LockResource
GetCommandLineW
GetComputerNameA
GetCurrentProcess
GetComputerNameW
GetTickCount
GetProcessTimes
OpenProcess
TerminateProcess
VirtualAlloc
Process32FirstW
Module32FirstW
Process32NextW
CreateToolhelp32Snapshot
CloseHandle
lstrcpyW
GetDateFormatW
CreateProcessW
CreateDirectoryW
SetHandleInformation
GetTimeFormatW
ReadFile
GetModuleFileNameW
GetLocalTime
CreatePipe
GetCurrentThreadId
GetFullPathNameW
GetFullPathNameA
CreateFileA
GetFileSize
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
QueryPerformanceCounter
UnlockFile
LockFile
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetFileAttributesA
GetFileAttributesW
CreateFileW
LoadResource
FlushFileBuffers
GetTempPathW
GetProcAddress
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
RtlUnwindEx
SetLastError
FlsFree
FlsGetValue
GetStdHandle
ExitProcess
GetModuleHandleW
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
FlsSetValue
HeapReAlloc
DecodePointer
EncodePointer
HeapAlloc
HeapFree
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetConsoleCP
GetConsoleMode
FindResourceW
GetPrivateProfileIntW
WritePrivateProfileStringW
LocalFree
GetPrivateProfileStringW
GetLastError
Sleep
LocalAlloc
LCMapStringW
RaiseException
RtlPcToFileHeader
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
GetProcessHeap
CompareStringW
MultiByteToWideChar
SetEnvironmentVariableA
HeapSize
GetLocaleInfoW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetTimeZoneInformation

user32

SendInput
GetKeyState
SetForegroundWindow
CallNextHookEx
EnumWindows
GetWindowTextW
EnableMenuItem
EnumChildWindows
SetWindowsHookExW
UnhookWindowsHookEx
IsWindowVisible
MoveWindow
MessageBoxW
ShowWindow
EnableWindow
SetActiveWindow
GetFocus
SetFocus
InvalidateRect
GetDlgItem
SendDlgItemMessageW
GetSysColor
GetDlgItemTextW
SetDlgItemTextW
UpdateWindow
ClientToScreen
GetWindowRect
GetClientRect
CreateDialogIndirectParamW
SetWindowPos
CreateDialogParamW
SendMessageW
DestroyWindow
SetWindowTextW

gdi32

SetBkMode
CreateFontW
CreateSolidBrush
SetTextColor

comdlg32

GetSaveFileNameW

advapi32

RegOpenKeyExA
RegQueryValueExW
GetTokenInformation
OpenProcessToken
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptAcquireContextW
LookupAccountSidW

shell32

CommandLineToArgvW

wininet

InternetSetOptionA
InternetConnectW
HttpOpenRequestW
InternetCrackUrlW
InternetQueryDataAvailable
DeleteUrlCacheEntryW
HttpAddRequestHeadersA
HttpSendRequestA
InternetCanonicalizeUrlW
InternetOpenA
InternetCloseHandle
InternetReadFile

ws2_32

gethostbyname

Exports

Exports

CLRCreateInstance
CallFunctionShim
CloseCtrs
ClrCreateManagedInstance
CoEEShutDownCOM
CoInitializeCor
CoInitializeEE
CoUninitializeCor
CoUninitializeEE
CollectCtrs
CorBindToCurrentRuntime
CorBindToRuntime
CorBindToRuntimeByCfg
CorBindToRuntimeByPath
CorBindToRuntimeByPathEx
CorBindToRuntimeEx
CorBindToRuntimeHost
CorDllMainWorker
CorExitProcess
CorGetSvc
CorIsLatestSvc
CorMarkThreadInThreadPool
CorTickleSvc
CreateConfigStream
CreateDebuggingInterfaceFromVersion
CreateInterface
DllRegisterServer
DllUnregisterServer
EEDllGetClassObjectFromClass
EEDllRegisterServer
EEDllUnregisterServer
GetAssemblyMDImport
GetCLRMetaHost
GetCORRequiredVersion
GetCORRootDirectory
GetCORSystemDirectory
GetCORVersion
GetCompileInfo
GetFileVersion
GetHashFromAssemblyFile
GetHashFromAssemblyFileW
GetHashFromBlob
GetHashFromFile
GetHashFromFileW
GetHashFromHandle
GetHostConfigurationFile
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
GetPermissionRequests
GetPrivateContextsPerfCounters
GetProcessExecutableHeap
GetRealProcAddress
GetRequestedRuntimeInfo
GetRequestedRuntimeVersion
GetRequestedRuntimeVersionForCLSID
GetStartupFlags
GetTargetForVTableEntry
GetTokenForVTableEntry
GetVersionFromProcess
GetXMLElement
GetXMLElementAttribute
GetXMLObject
IEE
InitErrors
InitSSAutoEnterThread
LoadLibraryShim
LoadLibraryWithPolicyShim
LoadStringRC
LoadStringRCEx
LockClrVersion
LogHelp_LogAssert
LogHelp_NoGuiOnAssert
LogHelp_TerminateOnAssert
MetaDataGetDispenser
ND_CopyObjDst
ND_CopyObjSrc
ND_RI2
ND_RI4
ND_RI8
ND_RU1
ND_WI2
ND_WI4
ND_WI8
ND_WU1
OpenCtrs
PostError
ReOpenMetaDataWithMemory
ReOpenMetaDataWithMemoryEx
RunDll32ShimW
RuntimeOSHandle
RuntimeOpenImage
RuntimeReleaseHandle
SetTargetForVTableEntry
StrongNameCompareAssemblies
StrongNameErrorInfo
StrongNameFreeBuffer
StrongNameGetBlob
StrongNameGetBlobFromImage
StrongNameGetPublicKey
StrongNameHashSize
StrongNameKeyDelete
StrongNameKeyGen
StrongNameKeyGenEx
StrongNameKeyInstall
StrongNameSignatureGeneration
StrongNameSignatureGenerationEx
StrongNameSignatureSize
StrongNameSignatureVerification
StrongNameSignatureVerificationEx
StrongNameSignatureVerificationFromImage
StrongNameTokenFromAssembly
StrongNameTokenFromAssemblyEx
StrongNameTokenFromPublicKey
TranslateSecurityAttributes
UpdateError
_CorImageUnloading
_CorValidateImage
beNotified
getFuncsArray
getName
isUnicode
messageProc
setInfo

Sections

.text
Size: 804KB - Virtual size: 803KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c2c167a499f4140e8f92ab4e66832ac

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

wininet

ws2_32

Exports

Exports

Sections

.text Size: 804KB - Virtual size: 803KB

.rdata Size: 179KB - Virtual size: 178KB

.data Size: 19KB - Virtual size: 40KB

.pdata Size: 39KB - Virtual size: 38KB

text Size: 7KB - Virtual size: 7KB

data Size: 25KB - Virtual size: 24KB

.rsrc Size: 37KB - Virtual size: 37KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 804KB - Virtual size: 803KB

.rdata
Size: 179KB - Virtual size: 178KB

.data
Size: 19KB - Virtual size: 40KB

.pdata
Size: 39KB - Virtual size: 38KB

text
Size: 7KB - Virtual size: 7KB

data
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 37KB - Virtual size: 37KB

.reloc
Size: 6KB - Virtual size: 5KB