67225926b2d387026abc94cd6fa2031f9f5081fa8a48d29e84fc6688ccf322df

Sharing

Copy URL Twitter E-mail

General

Target

67225926b2d387026abc94cd6fa2031f9f5081fa8a48d29e84fc6688ccf322df
Size

579KB
MD5

a099c9791c0980063fe6421c61706bce
SHA1

2538720e2c7e441d137d4b4e588db45c87e9a75f
SHA256

67225926b2d387026abc94cd6fa2031f9f5081fa8a48d29e84fc6688ccf322df
SHA512

6b975ea71d66eb01a404cd6b8114b4125799801e9a5a09de89b7375a686848ab97bef9a3d59efc12e63072c09531e9945c02561f6cc6aa1700318db4d9703045
SSDEEP

12288:+0P+5OUzHt8vAsOVdYztxLCfeaY2rx7CGGdcm4gxGF54C/EPBjvrEH7wBH:+QcO+tKAsOVmztxLCfeb2rFCGGdDtxGK

Score

1^/10

Malware Config

Signatures

Files

67225926b2d387026abc94cd6fa2031f9f5081fa8a48d29e84fc6688ccf322df
.dll regsvr32 windows:10 windows x86 arch:x86

3369df658952b3e5d422d2e07e95763b

Code Sign

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2016, 20:39

Not After

11/01/2018, 20:39

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:c0:08:4c:b6:4b:a1:ac:bc:15:0d:8c:12:eb:88:96:78:0b:3a:81:0e:3f:1f:c1:15:e6:95:96:6a:b6:6a:27
Signer

Actual PE Digest

6c:c0:08:4c:b6:4b:a1:ac:bc:15:0d:8c:12:eb:88:96:78:0b:3a:81:0e:3f:1f:c1:15:e6:95:96:6a:b6:6a:27

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

tiptsf.pdb

Imports

msvcrt

wcsrchr
calloc
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
__CxxFrameHandler3
_purecall
_except_handler4_common
??1type_info@@UAE@XZ
memset
_wcsicmp
_resetstkoflw
wcschr
_vsnwprintf
malloc
_beginthreadex
memmove_s
_lock
_unlock
__dllonexit
swprintf_s
_callnewh
_vsnprintf_s
realloc
_errno
_onexit
free
memcpy_s
wcsncpy_s
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_CxxThrowException
_ftol2
wcsstr
memcmp
memcpy

rpcrt4

NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release

api-ms-win-core-synch-l1-2-0

OpenEventW
Sleep
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
CreateMutexExW
CreateSemaphoreExW
OpenMutexW
TryEnterCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadResource
FindResourceExW
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
GetProcAddress
FreeLibrary
GetModuleFileNameW
SizeofResource

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap
HeapSize
HeapReAlloc

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
ProcessIdToSessionId
TlsFree
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
TlsSetValue
TlsGetValue
TlsAlloc

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
VirtualFree
MapViewOfFile
OpenFileMappingW
VirtualAlloc

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetVersionExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

user32

GetMessagePos
InSendMessageEx
IsIconic
CallWindowProcW
RegisterClassW
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
MapVirtualKeyW
MapVirtualKeyExW
SetPropW
RemovePropW
SendMessageW
SystemParametersInfoW
SendInput
GetMessageTime
GetSystemMetrics
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DestroyWindow
IsWindow
DefWindowProcW
SetWindowLongW
GetWindowBand
UnregisterClassA
IsRectEmpty
InflateRect
GetClassLongW
SetRectEmpty
GetWindow
GetDesktopWindow
GetComboBoxInfo
UnhookWinEvent
SetWinEventHook
GetPropW
IntersectRect
OffsetRect
EqualRect
PtInRect
GetUserObjectInformationW
GetThreadDesktop
GetClassNameW
IsChild
KillTimer
SetTimer
IsWindowVisible
ReleaseDC
GetDC
MapWindowPoints
ScreenToClient
GetWindowRect
GetMessageExtraInfo
GetPointerInfo
EndMenu
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyboardLayout
GetPointerPenInfo
GetPointerType
GetGUIThreadInfo
RealGetWindowClassW
GetAncestor
GetForegroundWindow
RegisterWindowMessageW
GetFocus
GetWindowThreadProcessId
GetParent
PostMessageW
GetWindowLongW
GetGestureInfo

ntdll

RtlGetNtSystemRoot
RtlDllShutdownInProgress
RtlPublishWnfStateData

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient8
ObjectStublessClient4
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient15
ObjectStublessClient13
ObjectStublessClient9
ObjectStublessClient10
ObjectStublessClient6
ObjectStublessClient16
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction6
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient22
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient23
ObjectStublessClient19
ObjectStublessClient17
ObjectStublessClient21
ObjectStublessClient24
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_AddRef
ObjectStublessClient5
CStdAsyncStubBuffer_Connect
ObjectStublessClient7
ObjectStublessClient3
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_QueryInterface
ObjectStublessClient25
CStdAsyncStubBuffer_Release

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-2-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrChrW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

Exports

Exports

AdviseHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EndCaretTracking
ProcessCaretEvents
ProcessCiceroCaretEvent
RestrictedModeMsgWndProc
StartCaretTracking
UnadviseHook

Sections

.text
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3369df658952b3e5d422d2e07e95763b

Code Sign

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

6c:c0:08:4c:b6:4b:a1:ac:bc:15:0d:8c:12:eb:88:96:78:0b:3a:81:0e:3f:1f:c1:15:e6:95:96:6a:b6:6a:27Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-version-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

user32

ntdll

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

Exports

Exports

Sections

.text Size: 376KB - Virtual size: 375KB

.data Size: 1KB - Virtual size: 5KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 384B

.rsrc Size: 79KB - Virtual size: 78KB

.reloc Size: 27KB - Virtual size: 26KB

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

6c:c0:08:4c:b6:4b:a1:ac:bc:15:0d:8c:12:eb:88:96:78:0b:3a:81:0e:3f:1f:c1:15:e6:95:96:6a:b6:6a:27
Signer

.text
Size: 376KB - Virtual size: 375KB

.data
Size: 1KB - Virtual size: 5KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 384B

.rsrc
Size: 79KB - Virtual size: 78KB

.reloc
Size: 27KB - Virtual size: 26KB