68318ab70e1f3522c770d6352dbc47f0c85310937befac635104301cd6e91385

Sharing

Copy URL Twitter E-mail

General

Target

68318ab70e1f3522c770d6352dbc47f0c85310937befac635104301cd6e91385
Size

199KB
MD5

149c9c4ec430e6be010793f582753a88
SHA1

9c9d465459299d0204b4449b8ebc55d3c7e23c13
SHA256

68318ab70e1f3522c770d6352dbc47f0c85310937befac635104301cd6e91385
SHA512

b19cc9b2a052d5d41ca95ad70c777a4acd850d0cbca3d981fb2d4566dadfbc496361f270d30b4e2a90a8b9baa4445099f53c3cccd530674312ef72e22127ee8c
SSDEEP

3072:CIQhumBRInRtRpegnWKHJCGQtJZzfsIUcUdGy+EpT7fEOSISbSylA:CIAyjR5LHJC3tzIdGTWfEOSRVi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68318ab70e1f3522c770d6352dbc47f0c85310937befac635104301cd6e91385

Files

68318ab70e1f3522c770d6352dbc47f0c85310937befac635104301cd6e91385
.dll regsvr32 windows:5 windows x86 arch:x86

9efe8dcc4e06eb4cb4a5c48d1668e5ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadResource
FindResourceW
LoadLibraryExW
IsBadStringPtrA
GetFileAttributesW
CloseHandle
CreateFileW
GetFileSizeEx
ReadFile
WriteFile
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleHandleA
LoadLibraryA
LockResource
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
QueryDosDeviceW
SizeofResource
VirtualQuery
GetCurrentProcess
PeekNamedPipe
GetTickCount
CreateProcessW
CreatePipe
GetFullPathNameW
WideCharToMultiByte
GetCurrentProcessId
GetProcessTimes
SetEnvironmentVariableW
GetEnvironmentVariableW
SetThreadLocale
GetThreadLocale
LCMapStringW
LoadLibraryW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
GetStringTypeW
MultiByteToWideChar
FreeLibrary
GetModuleFileNameW
VirtualFree
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
lstrlenW
IsBadStringPtrW
IsBadReadPtr
VirtualAlloc
GetLogicalDrives
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapReAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
GetStdHandle
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
HeapAlloc
HeapFree
RtlUnwind
DecodePointer
EncodePointer

user32

OffsetRect
IsWindow
IsRectEmpty
ReleaseDC
GetWindowDC
CharNextA
GetClientRect
GetDesktopWindow
ClientToScreen
IsIconic
LoadImageW
GetWindowRect
GetWindowInfo
LogicalToPhysicalPoint
CharNextW

gdi32

GetPixel
GetDeviceCaps
GetDIBits
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
DeleteObject
SelectObject

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysFreeString
RegisterTypeLi
UnRegisterTypeLi
SafeArrayDestroy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
VariantInit
VariantChangeType
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
VariantClear

psapi

GetMappedFileNameW

Exports

Exports

CPClntToScrn
CPClose
CPCmpColor
CPCmpColorEx
CPCopyPosArray
CPCreatePicTable
CPDeleteBMP
CPDeletePicTable
CPDisableDpi
CPExcludePos
CPFindColor
CPFindColorEx
CPFindMultiColor
CPFindMultiColorA
CPFindNearestPos
CPFindPic
CPFindPicA
CPFindPicN
CPFindPicNA
CPFindPos
CPGetColor
CPGetPosArrayCount
CPGetVersion
CPIsDisableDpi
CPLoadBMP
CPOpen
CPReadPosArray
CPReadPosItemArray
CPReleasePosArray
CPSetBMPTransparent
CPSetFPMaxColorCast
CPSetFPSimilar
CPSetMode
CPSnap
CPSortDistancePos
CPSortPos
CPWaitUpdate
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9efe8dcc4e06eb4cb4a5c48d1668e5ad

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

psapi

Exports

Exports

Sections

.text Size: 129KB - Virtual size: 129KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 9KB - Virtual size: 8KB