da6b8aa61c65b119ac3d7852670ec3455476b691c6ef7d378e45220adb13312b

Sharing

Copy URL Twitter E-mail

General

Target

da6b8aa61c65b119ac3d7852670ec3455476b691c6ef7d378e45220adb13312b
Size

435KB
MD5

742f3d76a092280d20feacfa869778d8
SHA1

f43348896adfd60f1a7f8b30f855478a86d8e9c8
SHA256

da6b8aa61c65b119ac3d7852670ec3455476b691c6ef7d378e45220adb13312b
SHA512

030860f3ce37f655324539cbed38aa2ff34170b5f2b236770aed40d456f6658851c1f7a2e2a1fe90c4ba374d0f56bf175855caf5032a06a970738156733c8e7d
SSDEEP

3072:tGHBaA94oqTSW1Qse0NgAHHHONLTuIsCLIt4vhshCOBwjMyyueohrRwY/9L9o:tKBp94oAP1HNlnHUB9vCBwjKlohH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da6b8aa61c65b119ac3d7852670ec3455476b691c6ef7d378e45220adb13312b

Files

da6b8aa61c65b119ac3d7852670ec3455476b691c6ef7d378e45220adb13312b
.dll windows:6 windows x86 arch:x86

14d3646ee370dfa4eb23291a72116ff9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\bt\942905\client\wld\setup\bldsetup\mail\lmcustom\obj\i386\lmcustom.pdb

Imports

kernel32

Sleep
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenEventW
TerminateProcess
MulDiv
GetExitCodeProcess
CreateProcessW
GetNativeSystemInfo
WideCharToMultiByte
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
DeleteFileW
ExitThread
CreateThread
GetCPInfo
RemoveDirectoryW
CreateDirectoryW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetVersionExW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
GetLocaleInfoW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
OpenMutexW
CreateEventW
GetLastError
ExpandEnvironmentStringsW
ResetEvent
GetTempPathW
GetTempFileNameW
InterlockedDecrement
SetEvent
CreateFileW
WriteFile
WaitForSingleObject
SetLastError
CloseHandle

user32

EnumWindows
GetWindowThreadProcessId
PostMessageW

shlwapi

PathQuoteSpacesW
StrFormatByteSizeW
UrlCreateFromPathW
PathCombineW
PathAppendW
StrCmpIW
SHDeleteKeyW
SHSetValueW
SHGetValueW
PathRemoveArgsW
StrCmpW
SHDeleteValueW
SHCopyKeyW
PathMatchSpecW

shell32

SHChangeNotify
ShellExecuteW

msi

ord114
ord116
ord119
ord171
ord34
ord8
ord32
ord159
ord160
ord124
ord205
ord70
ord49
ord103
ord74
ord121
ord17
ord125
ord118
ord145

ole32

OleRun
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
GetErrorInfo
VariantCopy
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantChangeType
SysFreeString
SysAllocString

wininet

HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile

crypt32

CertGetCertificateChain
CertFindCertificateInStore
CertVerifyCertificateChainPolicy
CryptQueryObject
CertGetNameStringW
CertFreeCertificateChain
CertFreeCertificateContext
CryptMsgGetParam
CertCloseStore
CryptMsgClose

wintrust

WinVerifyTrust

setupapi

SetupIterateCabinetW

advapi32

OpenServiceW
CloseServiceHandle
ControlService
OpenSCManagerW

Exports

Exports

AddExpectedTicks
BackupFileAssociations
CheckMailRunning
EnsureOptedIn
FindRelatedProductsJr
GetAUValues
OESPADDisable
OESPADEnable
RegisterClient
RenameHotmailDefaultMailClientIfNecessary
RevertFileAssociations
SetAUValues
SetAUValuesDeferred
ShutdownDesktopSearch
ShutdownWLMd
UnregisterClient

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14d3646ee370dfa4eb23291a72116ff9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

shell32

msi

ole32

oleaut32

wininet

crypt32

wintrust

setupapi

advapi32

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

.data Size: 5KB - Virtual size: 13KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 165KB - Virtual size: 164KB

.data
Size: 5KB - Virtual size: 13KB

.reloc
Size: 10KB - Virtual size: 9KB