1b69e2e1145533b05a2363abe807c8e6abc1eedc529b49de58ffe79720f01cd9

Sharing

Copy URL Twitter E-mail

General

Target

1b69e2e1145533b05a2363abe807c8e6abc1eedc529b49de58ffe79720f01cd9
Size

456KB
MD5

f7b6fdfb00d9f0e1584f3e0370712a47
SHA1

127328b24202004e3921164f8c3a138c064d4ded
SHA256

1b69e2e1145533b05a2363abe807c8e6abc1eedc529b49de58ffe79720f01cd9
SHA512

ec8e3c59cd4ef7deefa99825c14050c7c13d348cec9efd4df54287d36f4264c06ad7d141f7fd1b9ca7731552e480ac7a5986eb7c2deefed0679ce33df73b9338
SSDEEP

6144:tKBp94oAP1HNlnHUB9vL/HOd2x+Pggz8KBp94oAP1HNlnHUB9vl:tKBr4pP1HN29HO04ggIKBr4pP1HN2b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b69e2e1145533b05a2363abe807c8e6abc1eedc529b49de58ffe79720f01cd9

Files

1b69e2e1145533b05a2363abe807c8e6abc1eedc529b49de58ffe79720f01cd9
.dll windows:6 windows x86 arch:x86

14d3646ee370dfa4eb23291a72116ff9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\bt\942905\client\wld\setup\bldsetup\mail\lmcustom\obj\i386\lmcustom.pdb

Imports

kernel32

Sleep
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenEventW
TerminateProcess
MulDiv
GetExitCodeProcess
CreateProcessW
GetNativeSystemInfo
WideCharToMultiByte
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
DeleteFileW
ExitThread
CreateThread
GetCPInfo
RemoveDirectoryW
CreateDirectoryW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetVersionExW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
HeapSize
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
GetLocaleInfoW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
OpenMutexW
CreateEventW
GetLastError
ExpandEnvironmentStringsW
ResetEvent
GetTempPathW
GetTempFileNameW
InterlockedDecrement
SetEvent
CreateFileW
WriteFile
WaitForSingleObject
SetLastError
CloseHandle

user32

EnumWindows
GetWindowThreadProcessId
PostMessageW

shlwapi

PathQuoteSpacesW
StrFormatByteSizeW
UrlCreateFromPathW
PathCombineW
PathAppendW
StrCmpIW
SHDeleteKeyW
SHSetValueW
SHGetValueW
PathRemoveArgsW
StrCmpW
SHDeleteValueW
SHCopyKeyW
PathMatchSpecW

shell32

SHChangeNotify
ShellExecuteW

msi

ord114
ord116
ord119
ord171
ord34
ord8
ord32
ord159
ord160
ord124
ord205
ord70
ord49
ord103
ord74
ord121
ord17
ord125
ord118
ord145

ole32

OleRun
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
GetErrorInfo
VariantCopy
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantChangeType
SysFreeString
SysAllocString

wininet

HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile

crypt32

CertGetCertificateChain
CertFindCertificateInStore
CertVerifyCertificateChainPolicy
CryptQueryObject
CertGetNameStringW
CertFreeCertificateChain
CertFreeCertificateContext
CryptMsgGetParam
CertCloseStore
CryptMsgClose

wintrust

WinVerifyTrust

setupapi

SetupIterateCabinetW

advapi32

OpenServiceW
CloseServiceHandle
ControlService
OpenSCManagerW

Exports

Exports

AddExpectedTicks
BackupFileAssociations
CheckMailRunning
EnsureOptedIn
FindRelatedProductsJr
GetAUValues
OESPADDisable
OESPADEnable
RegisterClient
RenameHotmailDefaultMailClientIfNecessary
RevertFileAssociations
SetAUValues
SetAUValuesDeferred
ShutdownDesktopSearch
ShutdownWLMd
UnregisterClient

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14d3646ee370dfa4eb23291a72116ff9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

shell32

msi

ole32

oleaut32

wininet

crypt32

wintrust

setupapi

advapi32

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

.data Size: 5KB - Virtual size: 13KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 165KB - Virtual size: 164KB

.data
Size: 5KB - Virtual size: 13KB

.reloc
Size: 10KB - Virtual size: 9KB