7e541b9b386037874270e3218be6e0b640f1a98ec694120f5aa5c7e673d39fce

Sharing

Copy URL Twitter E-mail

General

Target

7e541b9b386037874270e3218be6e0b640f1a98ec694120f5aa5c7e673d39fce
Size

5.6MB
MD5

19a336888f24f152387a78c498bb93bd
SHA1

900ee2203def5a90a599a279e884c6088c1a282d
SHA256

7e541b9b386037874270e3218be6e0b640f1a98ec694120f5aa5c7e673d39fce
SHA512

7369db99acf7e712b31dd777e69a91659c9d1e1d57d365816e5c212b3a63228794be1414b1dfba12a5e83e2acf56ffe319d8d194598c8d168daa1fd7c39f04ca
SSDEEP

98304:r0p0NKi0PVlZF55vUAayVHl6u3mVwnICYCMAJoar:4KA7LPVHl9SCYCMAJoq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e541b9b386037874270e3218be6e0b640f1a98ec694120f5aa5c7e673d39fce

Files

7e541b9b386037874270e3218be6e0b640f1a98ec694120f5aa5c7e673d39fce
.dll windows:5 windows x86 arch:x86

7796464a934604ef0d418c01a96c9d3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

icuuc63

u_toupper_63
u_isspace_63
u_isalpha_63
u_tolower_63
u_isalnum_63

lcms2

cmsChannelsOf
cmsOpenProfileFromMem
cmsCloseProfile
cmsCreate_sRGBProfile
cmsCreateTransform
cmsDeleteTransform
cmsDoTransform
cmsGetColorSpace

advapi32

CryptReleaseContext
CryptAcquireContextW
CryptGenRandom

gdi32

CreateDIBSection
CreateDIBitmap
GetTextFaceA
PolyBezierTo
MoveToEx
CreateRectRgn
ExtCreatePen
WidenPath
StrokePath
StrokeAndFillPath
SetMiterLimit
GetClipRgn
GetRegionData
GetObjectW
CreatePen
CreateCompatibleDC
CreateFontIndirectA
DeleteDC
DeleteObject
GetCharWidthW
GetFontData
GetOutlineTextMetricsW
SelectObject
EnumFontFamiliesExA
ExtEscape
GdiComment
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateFontA
FillPath
CreateSolidBrush
GetClipBox
GetDeviceCaps
GetDIBits
GetObjectType
IntersectClipRect
LineTo
RestoreDC
SaveDC
SetDIBitsToDevice
SetPolyFillMode
StretchDIBits
SetStretchBltMode
GetTextMetricsW
BeginPath
CloseFigure
EndPath
SelectClipPath

user32

ReleaseDC
LoadImageW
FillRect
GetDC

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Xbad_alloc@std@@YAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?uncaught_exception@std@@YA_NXZ

kernel32

SetFilePointerEx
WriteFile
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetEvent
LoadLibraryA
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetEndOfFile
ResetEvent
ReadFile
GetFileSizeEx
FlushFileBuffers
CreateFileW
CreateFileA
WaitForSingleObjectEx
FreeLibrary
GetSystemDirectoryA
GetVersionExW
GetWindowsDirectoryA
RaiseException
SwitchToThread
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
IsWow64Process
GetCurrentProcess
GetSystemTime
GetCurrentProcessId
GetLocalTime
FindNextFileA
FindFirstFileExA
FindClose
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetLastError
SetLastError
CreateEventW

vcruntime140

_purecall
__std_type_info_destroy_list
_except_handler4_common
__std_exception_destroy
__std_exception_copy
strstr
__CxxFrameHandler3
__std_terminate
_CxxThrowException
__CxxLongjmpUnwind
memmove
memset
memcpy
memchr
strchr
wcschr
longjmp
_setjmp3

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_register_onexit_function
_initialize_onexit_table
_cexit
_initialize_narrow_environment
_crt_atexit
_initterm
_seh_filter_dll
terminate
_initterm_e
abort
_configure_narrow_argv
_execute_onexit_table
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fclose
fopen
fread
_fseeki64
ftell
__acrt_iob_func
__stdio_common_vswprintf
fwrite
__stdio_common_vsscanf
fseek
__stdio_common_vsprintf
_ftelli64

api-ms-win-crt-string-l1-1-0

_stricmp
_wcsupr
_wcslwr
_wcsicmp
_strupr
isdigit
isprint
strncpy
_strlwr
isalnum
isalpha
isxdigit
toupper
tolower
strncmp
iswdigit

api-ms-win-crt-time-l1-1-0

_localtime64
_tzset
_time64
wcsftime
_mktime64

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
_aligned_free
realloc
_callnewh
calloc
free
malloc

api-ms-win-crt-math-l1-1-0

frexp
_CIpow
_fdtest
roundf
_CItan
_CIatan2
_CIsqrt
_CIsin
_CIlog10
ceil
floor
_CIlog
_CIcos
_CIacos

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-convert-l1-1-0

strtol
_itoa
atoi

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

FORM_CanRedo
FORM_CanUndo
FORM_DoDocumentAAction
FORM_DoDocumentJSAction
FORM_DoDocumentOpenAction
FORM_DoPageAAction
FORM_ForceToKillFocus
FORM_GetFocusedText
FORM_GetSelectedText
FORM_OnAfterLoadPage
FORM_OnBeforeClosePage
FORM_OnChar
FORM_OnFocus
FORM_OnKeyDown
FORM_OnKeyUp
FORM_OnLButtonDown
FORM_OnLButtonUp
FORM_OnMouseMove
FORM_Redo
FORM_ReplaceSelection
FORM_SetSaveCallback
FORM_Undo
FPDFAction_GetDest
FPDFAction_GetFilePath
FPDFAction_GetType
FPDFAction_GetURIPath
FPDFAnnot_AppendAttachmentPoints
FPDFAnnot_AppendObject
FPDFAnnot_CountAttachmentPoints
FPDFAnnot_GetAP
FPDFAnnot_GetAttachmentPoints
FPDFAnnot_GetColor
FPDFAnnot_GetFlags
FPDFAnnot_GetFormFieldAtPoint
FPDFAnnot_GetFormFieldFlags
FPDFAnnot_GetLinkedAnnot
FPDFAnnot_GetObject
FPDFAnnot_GetObjectCount
FPDFAnnot_GetRect
FPDFAnnot_GetStringValue
FPDFAnnot_GetSubtype
FPDFAnnot_GetValueType
FPDFAnnot_HasAttachmentPoints
FPDFAnnot_HasKey
FPDFAnnot_IsObjectSupportedSubtype
FPDFAnnot_IsSupportedSubtype
FPDFAnnot_RemoveObject
FPDFAnnot_SetAP
FPDFAnnot_SetAttachmentPoints
FPDFAnnot_SetColor
FPDFAnnot_SetFlags
FPDFAnnot_SetRect
FPDFAnnot_SetStringValue
FPDFAnnot_UpdateObject
FPDFAttachment_GetFile
FPDFAttachment_GetName
FPDFAttachment_GetStringValue
FPDFAttachment_GetValueType
FPDFAttachment_HasKey
FPDFAttachment_SetFile
FPDFAttachment_SetStringValue
FPDFAvail_Create
FPDFAvail_Destroy
FPDFAvail_GetDocument
FPDFAvail_GetFirstPageNum
FPDFAvail_IsDocAvail
FPDFAvail_IsFormAvail
FPDFAvail_IsLinearized
FPDFAvail_IsPageAvail
FPDFBitmap_Create
FPDFBitmap_CreateEx
FPDFBitmap_Destroy
FPDFBitmap_FillRect
FPDFBitmap_GetBuffer
FPDFBitmap_GetFormat
FPDFBitmap_GetHeight
FPDFBitmap_GetStride
FPDFBitmap_GetWidth
FPDFBookmark_Find
FPDFBookmark_GetAction
FPDFBookmark_GetDest
FPDFBookmark_GetFirstChild
FPDFBookmark_GetNextSibling
FPDFBookmark_GetTitle
FPDFCatalog_IsTagged
FPDFDOC_ExitFormFillEnvironment
FPDFDOC_InitFormFillEnvironment
FPDFDest_GetDestPageIndex
FPDFDest_GetLocationInPage
FPDFDest_GetView
FPDFDoc_AddAttachment
FPDFDoc_DeleteAttachment
FPDFDoc_GetAttachment
FPDFDoc_GetAttachmentCount
FPDFDoc_GetPageMode
FPDFFont_Close
FPDFFormObj_CountObjects
FPDFFormObj_GetMatrix
FPDFFormObj_GetObject
FPDFImageObj_GetBitmap
FPDFImageObj_GetImageDataDecoded
FPDFImageObj_GetImageDataRaw
FPDFImageObj_GetImageFilter
FPDFImageObj_GetImageFilterCount
FPDFImageObj_GetImageMetadata
FPDFImageObj_LoadJpegFile
FPDFImageObj_LoadJpegFileInline
FPDFImageObj_SetBitmap
FPDFImageObj_SetMatrix
FPDFLink_CloseWebLinks
FPDFLink_CountQuadPoints
FPDFLink_CountRects
FPDFLink_CountWebLinks
FPDFLink_Enumerate
FPDFLink_GetAction
FPDFLink_GetAnnotRect
FPDFLink_GetDest
FPDFLink_GetLinkAtPoint
FPDFLink_GetLinkZOrderAtPoint
FPDFLink_GetQuadPoints
FPDFLink_GetRect
FPDFLink_GetURL
FPDFLink_LoadWebLinks
FPDFPageObjMark_CountParams
FPDFPageObjMark_GetName
FPDFPageObjMark_GetParamBlobValue
FPDFPageObjMark_GetParamIntValue
FPDFPageObjMark_GetParamKey
FPDFPageObjMark_GetParamStringValue
FPDFPageObjMark_GetParamValueType
FPDFPageObjMark_RemoveParam
FPDFPageObjMark_SetBlobParam
FPDFPageObjMark_SetIntParam
FPDFPageObjMark_SetStringParam
FPDFPageObj_AddMark
FPDFPageObj_CountMarks
FPDFPageObj_CreateNewPath
FPDFPageObj_CreateNewRect
FPDFPageObj_CreateTextObj
FPDFPageObj_Destroy
FPDFPageObj_GetBounds
FPDFPageObj_GetFillColor
FPDFPageObj_GetMark
FPDFPageObj_GetStrokeColor
FPDFPageObj_GetStrokeWidth
FPDFPageObj_GetType
FPDFPageObj_HasTransparency
FPDFPageObj_NewImageObj
FPDFPageObj_NewTextObj
FPDFPageObj_RemoveMark
FPDFPageObj_SetBlendMode
FPDFPageObj_SetFillColor
FPDFPageObj_SetLineCap
FPDFPageObj_SetLineJoin
FPDFPageObj_SetStrokeColor
FPDFPageObj_SetStrokeWidth
FPDFPageObj_Transform
FPDFPageObj_TransformClipPath
FPDFPage_CloseAnnot
FPDFPage_CountObject
FPDFPage_CountObjects
FPDFPage_CreateAnnot
FPDFPage_Delete
FPDFPage_Flatten
FPDFPage_FormFieldZOrderAtPoint
FPDFPage_GenerateContent
FPDFPage_GetAnnot
FPDFPage_GetAnnotCount
FPDFPage_GetAnnotIndex
FPDFPage_GetCropBox
FPDFPage_GetMediaBox
FPDFPage_GetObject
FPDFPage_GetRotation
FPDFPage_HasFormFieldAtPoint
FPDFPage_HasTransparency
FPDFPage_InsertClipPath
FPDFPage_InsertObject
FPDFPage_New
FPDFPage_RemoveAnnot
FPDFPage_RemoveObject
FPDFPage_SetCropBox
FPDFPage_SetMediaBox
FPDFPage_SetRotation
FPDFPage_TransFormWithClip
FPDFPage_TransformAnnots
FPDFPathSegment_GetClose
FPDFPathSegment_GetPoint
FPDFPathSegment_GetType
FPDFPath_BezierTo
FPDFPath_Close
FPDFPath_CountSegments
FPDFPath_GetDrawMode
FPDFPath_GetFillColor
FPDFPath_GetMatrix
FPDFPath_GetPathSegment
FPDFPath_GetStrokeColor
FPDFPath_LineTo
FPDFPath_MoveTo
FPDFPath_SetDrawMode
FPDFPath_SetFillColor
FPDFPath_SetLineCap
FPDFPath_SetLineJoin
FPDFPath_SetMatrix
FPDFPath_SetStrokeColor
FPDFPath_SetStrokeWidth
FPDFTextObj_GetFontName
FPDFTextObj_GetFontSize
FPDFTextObj_GetText
FPDFText_ClosePage
FPDFText_CountChars
FPDFText_CountRects
FPDFText_FindClose
FPDFText_FindNext
FPDFText_FindPrev
FPDFText_FindStart
FPDFText_GetBoundedText
FPDFText_GetCharBox
FPDFText_GetCharIndexAtPos
FPDFText_GetCharIndexFromTextIndex
FPDFText_GetCharOrigin
FPDFText_GetFontInfo
FPDFText_GetFontSize
FPDFText_GetMatrix
FPDFText_GetRect
FPDFText_GetSchCount
FPDFText_GetSchResultIndex
FPDFText_GetText
FPDFText_GetTextIndexFromCharIndex
FPDFText_GetTextRenderMode
FPDFText_GetUnicode
FPDFText_LoadFont
FPDFText_LoadPage
FPDFText_LoadStandardFont
FPDFText_SetFillColor
FPDFText_SetText
FPDF_AddInstalledFont
FPDF_CloseDocument
FPDF_ClosePage
FPDF_CountNamedDests
FPDF_CreateClipPath
FPDF_CreateNewDocument
FPDF_DestroyClipPath
FPDF_DestroyLibrary
FPDF_DeviceToPage
FPDF_FFLDraw
FPDF_FreeDefaultSystemFontInfo
FPDF_GetDefaultSystemFontInfo
FPDF_GetDefaultTTFMap
FPDF_GetDocPermissions
FPDF_GetFileVersion
FPDF_GetFormType
FPDF_GetLastError
FPDF_GetMetaText
FPDF_GetNamedDest
FPDF_GetNamedDestByName
FPDF_GetPageBoundingBox
FPDF_GetPageCount
FPDF_GetPageHeight
FPDF_GetPageLabel
FPDF_GetPageSizeByIndex
FPDF_GetPageWidth
FPDF_GetSecurityHandlerRevision
FPDF_InitLibrary
FPDF_InitLibraryWithConfig
FPDF_LoadCustomDocument
FPDF_LoadDocument
FPDF_LoadMemDocument
FPDF_LoadPage
FPDF_PageToDevice
FPDF_RemoveFormFieldHighlight
FPDF_RenderPage
FPDF_RenderPageBitmap
FPDF_RenderPageBitmapWithMatrix
FPDF_RenderPageBitmap_Start
FPDF_RenderPage_Close
FPDF_RenderPage_Continue
FPDF_SaveAsCopy
FPDF_SaveWithVersion
FPDF_SetFormFieldHighlightAlpha
FPDF_SetFormFieldHighlightColor
FPDF_SetPrintMode
FPDF_SetSandBoxPolicy
FPDF_SetSystemFontInfo
FPDF_StructElement_CountChildren
FPDF_StructElement_GetAltText
FPDF_StructElement_GetChildAtIndex
FPDF_StructElement_GetMarkedContentID
FPDF_StructElement_GetTitle
FPDF_StructElement_GetType
FPDF_StructTree_Close
FPDF_StructTree_CountChildren
FPDF_StructTree_GetChildAtIndex
FPDF_StructTree_GetForPage
FPDF_VIEWERREF_GetDuplex
FPDF_VIEWERREF_GetName
FPDF_VIEWERREF_GetNumCopies
FPDF_VIEWERREF_GetPrintPageRange
FPDF_VIEWERREF_GetPrintPageRangeCount
FPDF_VIEWERREF_GetPrintPageRangeElement
FPDF_VIEWERREF_GetPrintScaling
FSDK_SetTimeFunction
FSDK_SetUnSpObjProcessHandler
_opj_codec_set_threads@8
_opj_create_compress@4
_opj_create_decompress@4
_opj_decode@12
_opj_decode_tile_data@20
_opj_destroy_codec@4
_opj_destroy_cstr_index@4
_opj_destroy_cstr_info@4
_opj_dump_codec@12
_opj_encode@8
_opj_end_compress@8
_opj_end_decompress@8
_opj_get_cstr_index@4
_opj_get_cstr_info@4
_opj_get_decoded_tile@16
_opj_get_num_cpus@0
_opj_has_thread_support@0
_opj_image_create@12
_opj_image_data_alloc@4
_opj_image_data_free@4
_opj_image_destroy@4
_opj_image_tile_create@12
_opj_read_header@12
_opj_read_tile_header@40
_opj_set_MCT@16
_opj_set_decode_area@24
_opj_set_decoded_components@16
_opj_set_decoded_resolution_factor@8
_opj_set_default_decoder_parameters@4
_opj_set_default_encoder_parameters@4
_opj_set_error_handler@12
_opj_set_info_handler@12
_opj_set_warning_handler@12
_opj_setup_decoder@8
_opj_setup_encoder@12
_opj_start_compress@12
_opj_stream_create@8
_opj_stream_create_default_file_stream@8
_opj_stream_create_file_stream@12
_opj_stream_default_create@4
_opj_stream_destroy@4
_opj_stream_set_read_function@8
_opj_stream_set_seek_function@8
_opj_stream_set_skip_function@8
_opj_stream_set_user_data@12
_opj_stream_set_user_data_length@12
_opj_stream_set_write_function@8
_opj_version@0
_opj_write_tile@20

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7796464a934604ef0d418c01a96c9d3a

Headers

DLL Characteristics

File Characteristics

Imports

icuuc63

lcms2

advapi32

gdi32

user32

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 14KB - Virtual size: 27KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 111KB - Virtual size: 111KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 14KB - Virtual size: 27KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 111KB - Virtual size: 111KB