aa65f38edf8ebff8d7cd9dc72f01b0e0f652419feae85554d152ba32dab87264

Sharing

Copy URL Twitter E-mail

General

Target

aa65f38edf8ebff8d7cd9dc72f01b0e0f652419feae85554d152ba32dab87264
Size

569KB
MD5

b6f00b98cd9e2f327be64ebb55a82c71
SHA1

2caebfc219372ba00819fc9bb3e9016a4ff2deed
SHA256

aa65f38edf8ebff8d7cd9dc72f01b0e0f652419feae85554d152ba32dab87264
SHA512

e3564ec2b748675321d983d02e58f19a98b38f4a473d68f579cf6cd66a69a75ef5e66bfbc7aa4b89e2da3839711949b78580673b269f332e1df8f0ab5caf80a4
SSDEEP

12288:fYaTxAAdHXdkm4f3nL230aJvIW04kiznXn:fYaTvxXumiqZwLKzn3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa65f38edf8ebff8d7cd9dc72f01b0e0f652419feae85554d152ba32dab87264

Files

aa65f38edf8ebff8d7cd9dc72f01b0e0f652419feae85554d152ba32dab87264
.dll windows:6 windows x64 arch:x64

9a9a7900e70d9213ad3cbad61c55f918

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GetModuleFileNameA
CloseHandle
WaitForSingleObject
CreateEventA
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
WideCharToMultiByte
GetCurrentDirectoryA
CreateFileA
ReadFile
GetLastError
GetCurrentProcess
GetCurrentProcessId
K32GetModuleFileNameExA
CreateDirectoryA
DeleteFileA
WriteFile
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceA
Sleep
VirtualFree
VirtualQuery
CreateThread
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentThreadId
OpenThread
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
RaiseException
RtlCaptureContext
FreeLibraryAndExitThread
GetProcAddress
GetTickCount64
GetModuleHandleA
VirtualAlloc
FlushInstructionCache
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
DisableThreadLibraryCalls
InitializeSListHead
VirtualProtect
GetProcessHeap

user32

GetWindow
GetWindowThreadProcessId
GetClassNameA
EnumWindows
SetWindowLongPtrA
GetWindowLongPtrA
GetWindowRect
GetWindowTextA
IsWindowVisible
CallWindowProcA
EmptyClipboard
GetClipboardData
SetClipboardData
GetAsyncKeyState
CloseClipboard
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
MessageBoxA
TrackMouseEvent
GetMessageExtraInfo
GetKeyState
GetCapture
SetCapture
GetClientRect
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
OpenClipboard
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

urlmon

URLOpenBlockingStreamA

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

vcruntime140

__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__std_type_info_destroy_list
__C_specific_handler_noexcept
__current_exception_context
__current_exception
memmove
memcpy
memcmp
memchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
strstr
memset
__std_terminate
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_initterm
_cexit
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_crt_atexit
_initialize_onexit_table
_execute_onexit_table
_register_onexit_function
_initterm_e

api-ms-win-crt-string-l1-1-0

strncmp
tolower
strncpy_s
strcat_s
strncpy
strcpy_s
strcmp

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
calloc
free

api-ms-win-crt-convert-l1-1-0

atoi
atof

api-ms-win-crt-stdio-l1-1-0

ftell
fseek
fread
fflush
fwrite
_wfopen
__acrt_iob_func
feof
__stdio_common_vsprintf_s
fclose
__stdio_common_vfprintf
__stdio_common_vsscanf
__stdio_common_vsprintf

api-ms-win-crt-math-l1-1-0

log
logf
ceilf
fmodf
sqrtf
acosf
cosf
powf
pow
sinf

api-ms-win-crt-utility-l1-1-0

qsort

Exports

Exports

unload

Sections

.text
Size: 430KB - Virtual size: 429KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a9a7900e70d9213ad3cbad61c55f918

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

shell32

msvcp140

urlmon

d3dcompiler_47

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 430KB - Virtual size: 429KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 21KB - Virtual size: 20KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 430KB - Virtual size: 429KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 21KB - Virtual size: 20KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 1KB - Virtual size: 1KB