9740566fee7303471e0b0bf7260ce32223848dc2d2e443ccdc556a0d9e6697bc

Sharing

Copy URL Twitter E-mail

General

Target

9740566fee7303471e0b0bf7260ce32223848dc2d2e443ccdc556a0d9e6697bc
Size

186KB
MD5

937a5c7655d7b51f6be17685726ce3a4
SHA1

0f04c5e13348f49e01a0d4edb72618a17ab05bba
SHA256

9740566fee7303471e0b0bf7260ce32223848dc2d2e443ccdc556a0d9e6697bc
SHA512

36e41dd8927bc5aa11ad39e92a78b9729c65a30438641b09a7ab7e2fb49da347441752623b8492d44e2ef1731a153565c55ebb02be57a87a2389b58b4bf92011
SSDEEP

3072:MTPzGlrFTkyztNC9yq4ZeWt0R1FGb08cAWJXexV8h1BB63FnF:MqTkyzCucvO0SW9exV8ZB63Fn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9740566fee7303471e0b0bf7260ce32223848dc2d2e443ccdc556a0d9e6697bc

Files

9740566fee7303471e0b0bf7260ce32223848dc2d2e443ccdc556a0d9e6697bc
.dll windows:4 windows x64 arch:x64

2211c326ac4751cfdb5bde9d6844ccc3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

libiconv-2

libiconv
libiconv_open
libiconv_set_relocation_prefix

kernel32

CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
GetACP
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetThreadLocale
InitializeCriticalSection
LeaveCriticalSection
SetEvent
Sleep
TlsGetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbrtowc
mbstowcs
strtoul
wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron
_wgetcwd
getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-private-l1-1-0

memcpy
strchr
strrchr
strstr
wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
_close
_wopen
fclose
feof
fgets
fopen
fputc
fputwc
fwrite
putc
_read
_open

api-ms-win-crt-string-l1-1-0

isalnum
isalpha
isspace
mbrlen
memset
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
tolower
wcscmp
wcscpy
wcslen
_wcsdup
_stricmp
_strdup

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

Exports

Exports

DllMain
__imp_libintl_version
__printf__
_libintl_asnprintf
_libintl_asnwprintf
_libintl_explode_name
_libintl_find_domain
_libintl_find_msg
_libintl_free
_libintl_frexp
_libintl_frexpl
_libintl_gettext_extract_plural
_libintl_gettext_free_exp
_libintl_gettext_germanic_plural
_libintl_gettextparse
_libintl_glwthread_mutex_destroy
_libintl_glwthread_mutex_init
_libintl_glwthread_mutex_lock
_libintl_glwthread_mutex_trylock
_libintl_glwthread_mutex_unlock
_libintl_glwthread_once
_libintl_glwthread_recmutex_destroy
_libintl_glwthread_recmutex_init
_libintl_glwthread_recmutex_lock
_libintl_glwthread_recmutex_trylock
_libintl_glwthread_recmutex_unlock
_libintl_glwthread_rwlock_destroy
_libintl_glwthread_rwlock_init
_libintl_glwthread_rwlock_rdlock
_libintl_glwthread_rwlock_tryrdlock
_libintl_glwthread_rwlock_trywrlock
_libintl_glwthread_rwlock_unlock
_libintl_glwthread_rwlock_wrlock
_libintl_hard_locale
_libintl_language_preferences_default
_libintl_load_domain
_libintl_locale_name
_libintl_locale_name_canonicalize
_libintl_locale_name_default
_libintl_locale_name_environ
_libintl_locale_name_from_win32_LANGID
_libintl_locale_name_from_win32_LCID
_libintl_locale_name_posix
_libintl_locale_name_thread
_libintl_locale_name_thread_unsafe
_libintl_log_untranslated
_libintl_make_l10nflist
_libintl_mbrtowc
_libintl_mbsinit
_libintl_mbszero
_libintl_normalize_codeset
_libintl_printf_fetchargs
_libintl_printf_frexp
_libintl_printf_frexpl
_libintl_printf_parse
_libintl_relocate
_libintl_relocate2
_libintl_setlocale_null
_libintl_setlocale_null_r
_libintl_state_lock
_libintl_vasnprintf
_libintl_vasnwprintf
_libintl_wprintf_parse
_libintl_xmax
_libintl_xsum
_libintl_xsum3
_libintl_xsum4
_nl_expand_alias
_nl_msg_cat_cntr
bind_textdomain_codeset
bindtextdomain
dcgettext
dcngettext
dgettext
dngettext
gettext
libintl_asprintf
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dcigettext
libintl_dcngettext
libintl_dgettext
libintl_dngettext
libintl_fprintf
libintl_gettext
libintl_hash_string
libintl_ngettext
libintl_nl_current_default_domain
libintl_nl_default_default_domain
libintl_nl_default_dirname
libintl_nl_domain_bindings
libintl_set_relocation_prefix
libintl_setlocale
libintl_snprintf
libintl_sprintf
libintl_textdomain
libintl_vasprintf
libintl_version
libintl_vfprintf
libintl_vprintf
libintl_vsnprintf
libintl_vsprintf
libintl_wbindtextdomain
locale_charset
ngettext
textdomain

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2211c326ac4751cfdb5bde9d6844ccc3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

libiconv-2

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 139KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 24KB - Virtual size: 24KB

.pdata Size: 3KB - Virtual size: 3KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 5KB

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 140KB - Virtual size: 139KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 24KB - Virtual size: 24KB

.pdata
Size: 3KB - Virtual size: 3KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 5KB

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB