c6291717b104734c40d9f2acbcde97967136e30c3503bf3da4247c24e4693b3f

Sharing

Copy URL Twitter E-mail

General

Target

c6291717b104734c40d9f2acbcde97967136e30c3503bf3da4247c24e4693b3f
Size

444KB
MD5

9635adc44ebad69482dc2f99e34ff5a0
SHA1

94a250757ceb397583ea5a61840d5687c75640e3
SHA256

c6291717b104734c40d9f2acbcde97967136e30c3503bf3da4247c24e4693b3f
SHA512

17f04b86d225f7ea75fb5015daf4e31b98458359e74b67d0cd6dbe31dce1cc71aea2ead6baceabb706d8d6087ee66db6a7dd4546d922a34c26e655014032fd16
SSDEEP

12288:ahkLNQ5J/28BN5qz+HElAmvvolTdLvwgAjyiUJnV:aSxQ5JfBN5qz4m38lwg4yT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6291717b104734c40d9f2acbcde97967136e30c3503bf3da4247c24e4693b3f

Files

c6291717b104734c40d9f2acbcde97967136e30c3503bf3da4247c24e4693b3f
.dll windows:6 windows x86 arch:x86

94fa78841cec704c19bdedc40b00eaac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WindowsMedia.pdb

Imports

shlwapi

PathCreateFromUrlA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrcmpA
SetErrorMode
GetUserDefaultLangID
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExA
LoadResource
SizeofResource
lstrcmpiA
FindResourceA
IsDBCSLeadByte
VerSetConditionMask
CreateEventA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
GetComputerNameA
GetDiskFreeSpaceA
GlobalMemoryStatus
QueryPerformanceCounter
GetLocalTime
GetTickCount
GetCurrentProcessId
DeviceIoControl
LoadLibraryA
GetVersionExA
GetSystemInfo
LocalAlloc
LocalFree
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
SetEvent
CloseHandle
GetCurrentThreadId
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
RaiseException
DecodePointer
OutputDebugStringA
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
EncodePointer
VerifyVersionInfoW
GetSystemTimeAsFileTime

user32

RedrawWindow
UnregisterClassA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
RegisterWindowMessageA
SendMessageA
PostMessageA
DefWindowProcA
CallWindowProcA
RegisterClassExA
GetClassInfoExA
CreateWindowExA
IsWindow
IsChild
KillTimer
BringWindowToTop
ShowWindow
wsprintfA
LoadStringA
LoadCursorA
GetWindow
GetClassNameA
GetParent
GetDesktopWindow
SetWindowLongA
GetWindowLongA
FillRect
GetSysColor
ScreenToClient
ClientToScreen
SetCursor
GetClientRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
SetTimer
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableA
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextA
GetDlgItem
SetWindowPos
MoveWindow
DestroyWindow

gdi32

GetObjectA
SelectObject
GetStockObject
GetDeviceCaps
DeleteDC
CreateSolidBrush
CreateDIBSection
DeleteObject
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC

advapi32

RegOpenKeyExA
GetUserNameA
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

ole32

CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
OleUninitialize
OleLockRunning
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoCreateInstance
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal

oleaut32

LoadTypeLi
SysAllocString
VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi
SysFreeString
VariantClear
VariantInit
SysStringLen
SysAllocStringLen

msvcp120

?_Xbad_alloc@std@@YAXXZ
_Inf
?_Xlength_error@std@@YAXPBD@Z

msvcr120

strcmp
sprintf_s
wcslen
memcpy_s
_resetstkoflw
_recalloc
calloc
wcsncmp
strlen
memcpy
memcmp
malloc
_purecall
__CxxFrameHandler3
_CxxThrowException
??2@YAPAXI@Z
memset
wcscmp
??_V@YAXPAX@Z
free
_mbsnbcpy_s
_mbsstr
?terminate@@YAXXZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_except_handler4_common
_except1
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
??3@YAXPAX@Z
__clean_type_info_names_internal

Exports

Exports

GetAcrobatMPPInterface
WMCreateStreamForURL

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 240KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94fa78841cec704c19bdedc40b00eaac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

version

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp120

msvcr120

Exports

Exports

Sections

.text Size: 139KB - Virtual size: 138KB

.rdata Size: 33KB - Virtual size: 33KB

.data Size: 28KB - Virtual size: 30KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 240KB - Virtual size: 244KB

.text
Size: 139KB - Virtual size: 138KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 28KB - Virtual size: 30KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 240KB - Virtual size: 244KB