7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d

Sharing

Copy URL Twitter E-mail

General

Target

7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d
Size

370KB
MD5

82c91b46b109536b496fe608bc907083
SHA1

16425c5222b31509ec9a412acd6642e5b0891483
SHA256

7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d
SHA512

3ea3e1418a877b92647c5e3a6e9a6310630ab5647dcf135fecdec4fef0e3e9af7e7c2685124bbb977e0e67c4120026740b25650de7959da96b88012e4636613c
SSDEEP

3072:8z9qRBfL0PBxj3sX+t1uk586OtU/d6mi9gacjbblxT+14xEiwndOX5ip3xhs5A1K:OqXfAbPvuGHSsEi9pCs8Wb7fGB2Cc/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d

Files

7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d
.dll windows:6 windows x86 arch:x86

73f225d7e09827264a0c2f9cdd5bd567

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\_code\ToDoList_8.3\Plugins\Release\PluginHelpers.pdb

Imports

kernel32

SystemTimeToFileTime
FreeLibrary
GlobalSize
GetLastError
LocalFileTimeToFileTime
Sleep
lstrcpyW
GlobalUnlock
GlobalLock
MoveFileExW
FileTimeToSystemTime
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
LocalAlloc
MulDiv
GetACP
GetVersionExW
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
CreateProcessW
GetCurrentProcess
WaitForSingleObject
lstrcpyA
GetTimeFormatW
CloseHandle
GetTempPathW
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
LoadLibraryW
MultiByteToWideChar
lstrlenW
DecodePointer
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW

mfc140u

ord5882
ord13028
ord8776
ord8773
ord4881
ord3869
ord6579
ord1171
ord540
ord1179
ord2753
ord14573
ord3874
ord2994
ord6795
ord4477
ord3970
ord2534
ord2257
ord1182
ord12691
ord1655
ord8505
ord551
ord6592
ord2256
ord3182
ord1068
ord362
ord4648
ord13085
ord13086
ord3957
ord258
ord3316
ord846
ord261
ord4856
ord3236
ord3849
ord8757
ord8719
ord1687
ord1524
ord12643
ord14461
ord8499
ord4312
ord2899
ord4806
ord1711
ord13053
ord14623
ord12367
ord11971
ord11972
ord5893
ord6332
ord1449
ord973
ord6837
ord5114
ord1142
ord14606
ord13669
ord5585
ord5588
ord5581
ord500
ord8464
ord4834
ord8360
ord8756
ord14410
ord14409
ord14417
ord12884
ord4664
ord12762
ord2996
ord5117
ord1653
ord7069
ord5422
ord1185
ord554
ord8712
ord8225
ord13258
ord13257
ord13964
ord7027
ord9468
ord4882
ord14416
ord4663
ord1692
ord290
ord12559
ord5109
ord2389
ord4890
ord5322
ord8817
ord14137
ord1511
ord883
ord12569
ord845
ord6489
ord8345
ord7820
ord5419
ord1450
ord974
ord14657
ord12405
ord14604
ord12348
ord14411
ord12763
ord2990
ord5921
ord1690
ord1689
ord1525
ord1523
ord287
ord280
ord285
ord3009
ord4323
ord2378
ord2383
ord2385
ord266
ord265
ord2304
ord2345
ord7654
ord6220
ord13756
ord3305
ord3302
ord10255
ord8210
ord2761
ord1476
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord3833
ord11936
ord14588
ord8965
ord12220
ord6978
ord11392
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord6751
ord1513
ord296
ord286
ord1045
ord4815
ord2246
ord2390
ord6566
ord2522
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord1514
ord325
ord1053
ord2365
ord324
ord1052
ord2408
ord2411
ord2376
ord2410
ord485
ord2268
ord2374
ord2184
ord2300
ord2399
ord8123
ord12430
ord2209
ord6877
ord13544
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3371
ord3372
ord3265
ord12168
ord4886
ord1002
ord5533
ord6973
ord6865
ord5249
ord5549
ord5760
ord9350
ord5525
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord9209
ord1391
ord890
ord13070
ord1108
ord4171
ord1663
ord8182
ord2255
ord269
ord1043
ord2284
ord2242
ord6493
ord3146
ord13335
ord5172
ord10293
ord8742
ord4992
ord5007
ord4931
ord1713
ord9297
ord9377
ord3147
ord2993
ord3872
ord9128
ord8186
ord12126
ord12134
ord9127
ord2660
ord2768
ord10624
ord7485
ord2540
ord3971
ord884
ord1559
ord3954
ord7073
ord1070
ord4649
ord8365
ord8811
ord5210
ord13022
ord14123
ord14127
ord13019
ord14112
ord8881
ord14115
ord13694
ord14047
ord13293
ord13289
ord13087
ord13095
ord12867
ord12953
ord450
ord12578
ord12558
ord13775
ord13261
ord2520
ord6528
ord6486
ord3882

msimg32

GradientFill

shlwapi

PathIsRelativeW
PathIsURLW
PathCanonicalizeW
PathCreateFromUrlW

vcruntime140

_purecall
memmove
wcschr
wcsstr
__vcrt_InitializeCriticalSectionEx
__std_terminate
__FrameUnwindFilter
__CxxUnregisterExceptionObject
__CxxDetectRethrow
_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
memset
__CxxRegisterExceptionObject
memcpy
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_initialize_narrow_environment
terminate
_cexit
abort
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_errno
_initterm_e
_invalid_parameter_noinfo
_register_onexit_function
_initterm
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_wcsdup
_wcsnicmp
_wcsicmp
iswdigit
wcsncmp
strncmp

api-ms-win-crt-stdio-l1-1-0

fgetws
fgets
__stdio_common_vswprintf_s

api-ms-win-crt-convert-l1-1-0

_wtoi
_wtof

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_wmakepath_s

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-math-l1-1-0

_libm_sse2_sqrt_precise
_except1

user32

GetWindowLongW
IsRectEmpty
GetForegroundWindow
IntersectRect
GetWindowRect
GetSystemMetrics
ScreenToClient
SetCursor
RegisterClipboardFormatW
CloseClipboard
IsWindowVisible
GetMessagePos
LoadCursorW
GetParent
PtInRect
OffsetRect
InflateRect
DrawFocusRect
GetSysColor
GetClientRect
InvalidateRect
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
EnableWindow
ReleaseCapture
SetCapture
GetKeyState
GetFocus
GetClassInfoW
EmptyClipboard
SendMessageW
RegisterWindowMessageW
DestroyIcon
PeekMessageW
GetDlgItem
MessageBoxW
PostMessageW
CopyRect
IsWindow
SetWindowPos
GetClassNameW
IsDialogMessageW
SystemParametersInfoW
GetClipboardFormatNameW
WindowFromDC
GetDC
ReleaseDC
GetDesktopWindow
LoadImageW
DrawIconEx
GetScrollPos
GetTopWindow
SetForegroundWindow
MapDialogRect
GetIconInfo
TranslateMessage
DrawFrameControl
DispatchMessageW
OpenClipboard
SetClipboardData
GetClipboardData
UpdateWindow
CallWindowProcW
EnumClipboardFormats
DefWindowProcW
SetWindowLongW

gdi32

SetDIBits
GetObjectW
SaveDC
RoundRect
RestoreDC
GetStockObject
GetDIBits
GetDeviceCaps
DeleteObject
GetTextExtentPoint32W
Polygon
ExtTextOutW
TextOutW
SelectObject
Rectangle
RectVisible
PtVisible
IntersectClipRect
Escape
CreateSolidBrush
CreatePen
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
CopyMetaFileW

advapi32

GetTokenInformation
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW

shell32

ExtractIconExW
ShellExecuteW
SHGetSpecialFolderPathW

oleaut32

OleCreatePictureIndirect
VarUdateFromDate
VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
VariantClear

comctl32

ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Destroy
ImageList_DragLeave
ImageList_GetImageInfo
ImageList_EndDrag
ImageList_Draw
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_GetIconSize
_TrackMouseEvent
ImageList_DragEnter

api-ms-win-crt-multibyte-l1-1-0

_mbschr

mscoree

_CorDllMain

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73f225d7e09827264a0c2f9cdd5bd567

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

mfc140u

msimg32

shlwapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

user32

gdi32

advapi32

shell32

oleaut32

comctl32

api-ms-win-crt-multibyte-l1-1-0

mscoree

Sections

.text Size: 189KB - Virtual size: 189KB

.rdata Size: 161KB - Virtual size: 161KB

.data Size: 4KB - Virtual size: 10KB

.gfids Size: 512B - Virtual size: 76B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 189KB - Virtual size: 189KB

.rdata
Size: 161KB - Virtual size: 161KB

.data
Size: 4KB - Virtual size: 10KB

.gfids
Size: 512B - Virtual size: 76B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 12KB - Virtual size: 11KB