1b9303310f79b1a8b9a003b6825bdc29e93eba3f3293af1912e7773709c98a26

Sharing

Copy URL

Twitter E-mail

General

Target

1b9303310f79b1a8b9a003b6825bdc29e93eba3f3293af1912e7773709c98a26
Size

582KB
MD5

9bea152094cde8ecfe4a5f31296080fb
SHA1

ff90800546b25c282898cf14d9243ad670b7fc67
SHA256

1b9303310f79b1a8b9a003b6825bdc29e93eba3f3293af1912e7773709c98a26
SHA512

f33a2f382a0b8f33b287fda326449a157266aedafd18abef52003f58d5e861f7c7d088faa942106dc49daf904d3a8bb6544cca8982a183237ea6cd8915f72f24
SSDEEP

12288:sCMuvHWPbLmZ7Gk1Rw8mtq8MytWMfgbXl1cngRV4rI4lo3x:sCMuvHWDKqkT/8MuxfuvcnNI4l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b9303310f79b1a8b9a003b6825bdc29e93eba3f3293af1912e7773709c98a26

Files

1b9303310f79b1a8b9a003b6825bdc29e93eba3f3293af1912e7773709c98a26
.dll windows:6 windows x64 arch:x64

dbf7a59326b5d5a7b3020210c91db217

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

GetModuleFileNameA
CloseHandle
WaitForSingleObject
CreateEventA
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
WideCharToMultiByte
GetCurrentDirectoryA
CreateFileA
ReadFile
GetLastError
GetCurrentProcess
GetCurrentProcessId
K32GetModuleFileNameExA
CreateDirectoryA
DeleteFileA
WriteFile
FreeResource
LoadResource
LockResource
Sleep
FindResourceA
VirtualAlloc
CreateThread
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentThreadId
OpenThread
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
RaiseException
RtlCaptureContext
FreeLibraryAndExitThread
GetProcAddress
GetTickCount64
GetModuleHandleA
SizeofResource
RtlLookupFunctionEntry
RtlVirtualUnwind
FlushInstructionCache
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
DisableThreadLibraryCalls
InitializeSListHead
VirtualFree
GetProcessHeap

user32

GetWindowThreadProcessId
GetWindow
GetClassNameA
EnumWindows
SetWindowLongPtrA
GetWindowLongPtrA
GetWindowRect
GetWindowTextA
GetAsyncKeyState
IsWindowVisible
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
CallWindowProcA
LoadCursorA
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
MessageBoxA
TrackMouseEvent
GetClientRect
GetMessageExtraInfo
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

urlmon

URLOpenBlockingStreamA

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

vcruntime140

__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__std_type_info_destroy_list
__C_specific_handler_noexcept
__current_exception_context
__current_exception
__C_specific_handler
memmove
memcmp
memchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
strstr
memset
__std_terminate
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_seh_filter_dll
_crt_atexit
_execute_onexit_table
_register_onexit_function
_configure_narrow_argv
_initialize_onexit_table
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

strcmp
tolower
strncpy_s
strcat_s
strcpy_s
strncmp
strncpy

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
malloc
free

api-ms-win-crt-convert-l1-1-0

atoi
atof

api-ms-win-crt-stdio-l1-1-0

ftell
fseek
fread
fflush
fclose
_wfopen
__acrt_iob_func
__stdio_common_vfprintf
feof
__stdio_common_vsprintf_s
fwrite
__stdio_common_vsscanf
__stdio_common_vsprintf

api-ms-win-crt-math-l1-1-0

sinf
cosf
log
logf
acosf
ceilf
fmodf
sqrtf
powf
pow

api-ms-win-crt-utility-l1-1-0

qsort

Exports

Exports

unload

Sections

.text
Size: 442KB - Virtual size: 441KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbf7a59326b5d5a7b3020210c91db217

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

shell32

msvcp140

urlmon

d3dcompiler_47

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 442KB - Virtual size: 441KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 21KB - Virtual size: 21KB

.rsrc Size: 23KB - Virtual size: 23KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 442KB - Virtual size: 441KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 23KB - Virtual size: 23KB

.reloc
Size: 1KB - Virtual size: 1KB