26ab3d3572a800409570d944baa4a74a6bb5bcffa5fe165e67d21a125d68cc3c

Sharing

Copy URL Twitter E-mail

General

Target

26ab3d3572a800409570d944baa4a74a6bb5bcffa5fe165e67d21a125d68cc3c
Size

256KB
MD5

458536373778cce9ad6532111fda03b1
SHA1

cbb1e17553c795508b7233ad34d13a147c8ceb1c
SHA256

26ab3d3572a800409570d944baa4a74a6bb5bcffa5fe165e67d21a125d68cc3c
SHA512

7087a46da947271d7bcba6a0796a048beabe08411a3f165f82ca68319de321e1a141032412ba45ae0cd0289d88542a5f585ed72f28399e1c42fb7a92b03cc9ff
SSDEEP

6144:hfU8DaSkcc86ERYe1zFB6N09Ak4jUWXsfluMtI:xU8D7cRqYe0KHWOjm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26ab3d3572a800409570d944baa4a74a6bb5bcffa5fe165e67d21a125d68cc3c

Files

26ab3d3572a800409570d944baa4a74a6bb5bcffa5fe165e67d21a125d68cc3c
.dll regsvr32 windows:5 windows x86 arch:x86

fbe572464711a23e5394eb44046825c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileW
GetFileSizeEx
ReadFile
WriteFile
IsBadReadPtr
IsBadStringPtrW
lstrlenW
GetProcAddress
GetModuleHandleW
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
IsBadStringPtrA
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryW
Sleep
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleHandleA
LoadLibraryA
LockResource
DeleteFileW
QueryDosDeviceW
GetLogicalDrives
GetCurrentProcess
PeekNamedPipe
CreateProcessW
CreatePipe
GetFullPathNameW
WideCharToMultiByte
DeviceIoControl
GetCurrentProcessId
GetProcessTimes
SetEnvironmentVariableW
GetEnvironmentVariableW
SetThreadLocale
GetThreadLocale
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
SetFilePointer
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
LCMapStringW
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
WriteConsoleW
HeapReAlloc
GetFileAttributesW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
VirtualAlloc
VirtualQuery
VirtualFree
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
GetStdHandle
ExitProcess
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCommandLineA
InterlockedExchange
GetSystemInfo
VirtualProtect
RtlUnwind
HeapFree
HeapAlloc
DecodePointer
EncodePointer

user32

GetAsyncKeyState
GetKeyState
SendMessageW
PostMessageW
IsWindow
CharNextW
CharNextA
OpenClipboard
CloseClipboard
SetClipboardData
SetRectEmpty
GetPhysicalCursorPos
SystemParametersInfoW
PtInRect
PostQuitMessage
PeekMessageW
TranslateMessage
DispatchMessageW
IsProcessDPIAware
GetWindowDC
ReleaseDC
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplaySettingsW
GetDesktopWindow
GetTopWindow
EmptyClipboard

gdi32

GetDeviceCaps

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

ole32

CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance

oleaut32

VariantInit
SysAllocString
RegisterTypeLi
UnRegisterTypeLi
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SysFreeString
VariantCopyInd
VariantChangeType
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
VariantClear

psapi

GetMappedFileNameW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
HKMCheckPressedKeys
HKMClose
HKMDelayRnd
HKMEnableOSMouseAccelerate
HKMFreeData
HKMGetCursorPos
HKMGetCursorPos2
HKMGetDataCount
HKMGetDataUnitInt
HKMGetDevInfo
HKMGetDevString
HKMGetKeyboardLEDState
HKMGetKeyboardMode
HKMGetMouseMode
HKMGetOSMouseSpeed
HKMGetSerialNumber
HKMGetVersion
HKMIsKeyBusy
HKMIsKeyDown
HKMIsMouseBusy
HKMIsMouseButtonDown
HKMIsOSMouseAccelerateEnabled
HKMIsOpen
HKMKeyDown
HKMKeyPress
HKMKeyUp
HKMLeftClick
HKMLeftDoubleClick
HKMLeftDown
HKMLeftUp
HKMMiddleClick
HKMMiddleDoubleClick
HKMMiddleDown
HKMMiddleUp
HKMMouseWheel
HKMMouseWheelP
HKMMoveR
HKMMoveR2
HKMMoveRP
HKMMoveTo
HKMOpen
HKMOpen2
HKMOutputString
HKMReleaseKeyboard
HKMReleaseMouse
HKMRightClick
HKMRightDoubleClick
HKMRightDown
HKMRightUp
HKMSearchDevice
HKMSearchDevice2
HKMSearchDeviceAll
HKMSetAbsMouseScrnRes
HKMSetKeyInterval
HKMSetLightMode
HKMSetMode
HKMSetMouseInterval
HKMSetMouseMoveTimeout
HKMSetMousePosMaxOffset
HKMSetMousePosPrecision
HKMSetMouseSpeed
HKMSetOSMouseSpeed
HKMSetResetMode
HKMSetResetTime
HKMVerifyUserData
HKMVerifyUserData2
HKMXBtn1Click
HKMXBtn1DoubleClick
HKMXBtn1Down
HKMXBtn1Up
HKMXBtn2Click
HKMXBtn2DoubleClick
HKMXBtn2Down
HKMXBtn2Up

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbe572464711a23e5394eb44046825c2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

psapi

Exports

Exports

Sections

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 17KB - Virtual size: 296KB

.rsrc Size: 31KB - Virtual size: 30KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 17KB - Virtual size: 296KB

.rsrc
Size: 31KB - Virtual size: 30KB

.reloc
Size: 12KB - Virtual size: 12KB