46fc63b9b4282b86b061d183f99bf173c381a1fdef07cec2ec18d537b0ff37c3

Sharing

Copy URL Twitter E-mail

General

Target

46fc63b9b4282b86b061d183f99bf173c381a1fdef07cec2ec18d537b0ff37c3
Size

426KB
MD5

7b740bbcf898231795b2a8a361fce974
SHA1

c625e7cfc7661c587efadfa4569af95778b5a619
SHA256

46fc63b9b4282b86b061d183f99bf173c381a1fdef07cec2ec18d537b0ff37c3
SHA512

02deacc779ad6e406d6cf447ee212c9af48a9cdca285066da3ec47d87e59ec95de2882a2e66057170a21919a11b2447a2289328f6a2ea850737c7995b7820eaa
SSDEEP

12288:iFE7TT5vJN2pchzxFqCHYSuf6FSS2dvBjvrEH7ff:dTBJN2pc3FrHYSufg2ddrEH7ff

Score

1^/10

Malware Config

Signatures

Files

46fc63b9b4282b86b061d183f99bf173c381a1fdef07cec2ec18d537b0ff37c3
.dll windows:10 windows x86 arch:x86

80c75f1700f44721ed32afe42628a671

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2015, 17:15

Not After

18/11/2016, 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:66:e2:34:26:75:bb:5a:84:68:ab:b3:65:46:30:23:5c:cd:b7:12:71:33:c1:90:dd:f1:a1:c6:4d:93:ab:10
Signer

Actual PE Digest

d2:66:e2:34:26:75:bb:5a:84:68:ab:b3:65:46:30:23:5c:cd:b7:12:71:33:c1:90:dd:f1:a1:c6:4d:93:ab:10

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

coml2.pdb

Imports

msvcrt

_lock
memcmp
_ftol2
_XcptFilter
_vsnwprintf
_purecall
_unlock
_wcsnicmp
wcsstr
_resetstkoflw
wcsncmp
memmove
qsort
_onexit
memcpy
_wcsicmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
__dllonexit
memset

api-ms-win-core-com-private-l1-1-1

CleanupTlsComl2State
CleanupComl2StateInAllTls

api-ms-win-core-com-private-l1-1-0

FreePropVariantArrayWorker
InternalServerExceptionFilter
InternalCoStdMarshalObject
InternalTlsAllocData

ntdll

RtlImageNtHeader
RtlAllocateHeap
NtSetInformationFile
RtlGetCurrentDirectory_U
NtCreateFile
RtlInitUnicodeString
NtClose
RtlFreeHeap
RtlDosPathNameToNtPathName_U
RtlRaiseStatus
NtMapViewOfSection
NtQueryInformationFile
NtQueryVolumeInformationFile
RtlInitializeCriticalSectionAndSpinCount
RtlNtStatusToDosError
NtQuerySystemInformation
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlInitializeCriticalSection
NtQueryObject

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-2-1

GetFileSize
GetFileInformationByHandle
GetFileTime
UnlockFile
LockFile
FlushFileBuffers
WriteFile
SetEndOfFile
GetTempPathW
GetFileType
SetFileTime
CreateFileW
GetFileAttributesW
GetFullPathNameW
ReadFile
SetFilePointer
DeleteFileW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-io-l1-1-1

GetOverlappedResult

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameW

api-ms-win-core-localization-l1-2-1

GetACP
GetUserDefaultLCID

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
FlushViewOfFile
VirtualAlloc
MapViewOfFileEx
CreateFileMappingW

api-ms-win-core-processthreads-l1-1-2

SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenThreadToken
GetCurrentThread
ProcessIdToSessionId
OpenProcess
OpenProcessToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

OpenEventW
LeaveCriticalSection
EnterCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
Sleep

api-ms-win-core-sysinfo-l1-2-1

GetSystemTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-2-0

AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
IsValidSecurityDescriptor
InitializeAcl
AllocateLocallyUniqueId

api-ms-win-core-com-l1-1-1

CLSIDFromString
StringFromCLSID
PropVariantClear
CoGetMalloc
CoTaskMemFree
CoCreateInstance
PropVariantCopy
CoUnmarshalInterface
CoGetStandardMarshal
CoTaskMemRealloc
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

api-ms-win-core-string-l2-1-0

IsCharAlphaW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
GlobalFree
GlobalUnlock
GlobalAlloc
LocalFree
GlobalLock
GlobalSize

api-ms-win-core-kernel32-legacy-l1-1-1

GlobalMemoryStatus

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

bcryptprimitives

ProcessPrng

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

Coml2DllGetClassObject
CreateILockBytesOnHGlobal
DllGetClassObject
FmtIdToPropStgName
GetConvertStg
GetHGlobalFromILockBytes
PropStgNameToFmtId
ReadClassStg
ReadClassStm
StgCreateDocfile
StgCreateDocfileOnILockBytes
StgCreatePropSetStg
StgCreatePropStg
StgCreateStorageEx
StgIsStorageFile
StgIsStorageILockBytes
StgOpenPropStg
StgOpenStorage
StgOpenStorageEx
StgOpenStorageOnILockBytes
StgSetTimes
WriteClassStg
WriteClassStm

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80c75f1700f44721ed32afe42628a671

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

d2:66:e2:34:26:75:bb:5a:84:68:ab:b3:65:46:30:23:5c:cd:b7:12:71:33:c1:90:dd:f1:a1:c6:4d:93:ab:10Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-com-private-l1-1-1

api-ms-win-core-com-private-l1-1-0

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-apiquery-l1-1-0

bcryptprimitives

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 323KB - Virtual size: 322KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 100B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 9KB - Virtual size: 9KB

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

d2:66:e2:34:26:75:bb:5a:84:68:ab:b3:65:46:30:23:5c:cd:b7:12:71:33:c1:90:dd:f1:a1:c6:4d:93:ab:10
Signer

.text
Size: 323KB - Virtual size: 322KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 100B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 9KB - Virtual size: 9KB