cfd43359b06df4c2d1d6ba2624fcf03e4848210f00951d067ec17608310cfde5

Sharing

Copy URL Twitter E-mail

General

Target

cfd43359b06df4c2d1d6ba2624fcf03e4848210f00951d067ec17608310cfde5
Size

677KB
MD5

127836037bf6f50d270ca305239862f3
SHA1

4ba3bdb8a1351eab99e09e1ef7bc6995aefbeb49
SHA256

cfd43359b06df4c2d1d6ba2624fcf03e4848210f00951d067ec17608310cfde5
SHA512

5b86ac15ee2f65d946c33cf09c5c4fa96ea12f081fa89705729afdba8d69c1b1c5abc82c3789d24b3c284f304e39e398836d398ef7686bd0d4b420a0d5b6ef57
SSDEEP

6144:nwIqk1/8PfckW8i0hV159bMqi4heTd1jz72zVMSZ1:wUUPfckW8HL1HIP/L2zVMSZ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfd43359b06df4c2d1d6ba2624fcf03e4848210f00951d067ec17608310cfde5

Files

cfd43359b06df4c2d1d6ba2624fcf03e4848210f00951d067ec17608310cfde5
.dll windows:4 windows x86 arch:x86

bb172f7ed95b0b9921a21c85ee75b4e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueW
StartServiceW

gdi32

CreateBitmapIndirect
DeleteObject
GetBitmapBits
GetObjectW

kernel32

ActivateActCtx
CloseHandle
CompareStringOrdinal
CreateEventW
CreateMutexW
CreateProcessW
CreateThread
DeactivateActCtx
DelayLoadFailureHook
DeleteCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsW
FindActCtxSectionGuid
FindActCtxSectionStringW
FreeLibrary
GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GlobalAlloc
GlobalFree
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrW
IsWow64Process
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalReAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReleaseActCtx
ReleaseMutex
ResolveDelayLoadedAPI
RtlUnwind
SearchPathW
SetEvent
Sleep
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection

ntdll

NtClose
NtCreateKey
NtOpenKey
RtlInitUnicodeString
RtlNtStatusToDosError
_vsnprintf

ole32

DestroyRunningObjectTable
GetClassFile
Ole32DllGetClassObject

rpcrt4

I_RpcExceptionFilter
I_RpcFreeBuffer
I_RpcGetBuffer
I_RpcSendReceive
NdrClientContextMarshall
NdrClientContextUnmarshall
NdrClientInitializeNew
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConvert
NdrFreeBuffer
NdrGetBuffer
NdrPointerBufferSize
NdrPointerMarshall
NdrPointerUnmarshall
NdrSendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingInqObject
RpcBindingSetObject
RpcRaiseException
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcStringBindingComposeW
RpcStringFreeW
UuidCreate
UuidCreateNil

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_strdup
_wcsdup
_wcsicmp
calloc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
strchr
strcmp
strcspn
strlen
wcscat
wcschr
wcslen

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetClipboardFormatNameW
GetMessageW
InSendMessage
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
RegisterClassW
RegisterClipboardFormatW
SendMessageW
TranslateMessage
UnregisterClassW
wsprintfW

Exports

Exports

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CleanupOleStateInAllTls
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFileTimeNow
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterChannelHook
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HACCEL_UserUnmarshal
HBITMAP_UserFree
HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HBRUSH_UserFree
HBRUSH_UserMarshal
HBRUSH_UserSize
HBRUSH_UserUnmarshal
HDC_UserFree
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HMENU_UserFree
HMENU_UserMarshal
HMENU_UserSize
HMENU_UserUnmarshal
HPALETTE_UserFree
HPALETTE_UserMarshal
HPALETTE_UserSize
HPALETTE_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalIrotEnumRunning
InternalIrotGetObject
InternalIrotGetTimeOfLastChange
InternalIrotIsRunning
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalReleaseMarshalObjRef
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 164KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb172f7ed95b0b9921a21c85ee75b4e7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

ntdll

ole32

rpcrt4

ucrtbase

user32

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 160KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 8KB - Virtual size: 5KB

.rdata Size: 60KB - Virtual size: 59KB

/4 Size: 36KB - Virtual size: 32KB

.edata Size: 12KB - Virtual size: 11KB

.idata Size: 8KB - Virtual size: 5KB

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 164KB - Virtual size: 160KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 8KB - Virtual size: 5KB

.rdata
Size: 60KB - Virtual size: 59KB

/4
Size: 36KB - Virtual size: 32KB

.edata
Size: 12KB - Virtual size: 11KB

.idata
Size: 8KB - Virtual size: 5KB

.reloc
Size: 12KB - Virtual size: 10KB