6dee5a72e31283c0794c022e21e82539f2df7f1aef08a425ebbc8b0d2a492cf9

Sharing

Copy URL Twitter E-mail

General

Target

6dee5a72e31283c0794c022e21e82539f2df7f1aef08a425ebbc8b0d2a492cf9
Size

223KB
MD5

2246c5b10e7771d4d1bded9f7706fc80
SHA1

61645bbba10c3442574f465b2f40eeacbfe1402a
SHA256

6dee5a72e31283c0794c022e21e82539f2df7f1aef08a425ebbc8b0d2a492cf9
SHA512

7cd8eac4f04c794c5814a65492ab6f4b490a756cd2e1bd69e9b6b80d9a69692ca61a88f27af60b8bac938776e273e8be519e05508b2692f27c3ce8b802e03d29
SSDEEP

3072:2UwQSJfYXka9VnN4pXqwcgfbkslF1ZTJ9lp+Ags:/S+DF4pzhrDjp+Ns

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6dee5a72e31283c0794c022e21e82539f2df7f1aef08a425ebbc8b0d2a492cf9

Files

6dee5a72e31283c0794c022e21e82539f2df7f1aef08a425ebbc8b0d2a492cf9
.dll windows:4 windows x64 arch:x64

ef4365dd976811d458bf80d35676903a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegGetValueW
RegOpenKeyW
RegSetValueExW

gdi32

CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W
LPtoDP
SelectObject

kernel32

DelayLoadFailureHook
GetModuleHandleW
GetTickCount
GlobalFlags
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
HeapAlloc
HeapReAlloc
IsBadStringPtrA
IsBadStringPtrW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ResolveDelayLoadedAPI

kernelbase

EnterCriticalSection
FreeLibrary
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
InitOnceExecuteOnce
IsDBCSLeadByte
LCMapStringW
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
VerQueryValueW
WideCharToMultiByte

ntdll

RtlNtStatusToDosError
RtlSetLastWin32Error
_vsnprintf

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
calloc
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
memset
strchr
strcmp
strcspn
strlen
wcscpy
wcslen
wcsrchr

user32

ActivateKeyboardLayout
BeginPaint
ClientToScreen
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyWindow
DrawTextW
EndPaint
EnumChildWindows
FillRect
GetClientRect
GetFocus
GetKeyboardLayout
GetKeyboardState
GetMonitorInfoW
GetWindowLongPtrW
GetWindowRect
IntersectRect
IsWindow
LoadCursorW
LoadIconW
MapWindowPoints
MonitorFromPoint
MonitorFromWindow
PostMessageW
RedrawWindow
RegisterClassExW
RegisterWindowMessageW
SendMessageA
SendMessageW
SetFocus
SetWindowLongPtrW
SetWindowPos
ShowWindow
ToAscii
ToUnicodeEx
UnregisterClassW
User32InitializeImmEntryTable

win32u

NtUserAssociateInputContext
NtUserBuildHimcList
NtUserCallHwnd
NtUserCreateInputContext
NtUserDestroyInputContext
NtUserDisableThreadIme
NtUserMessageCall
NtUserNotifyIMEStatus
NtUserQueryInputContext
NtUserUpdateInputContext

Exports

Exports

ImmActivateLayout
ImmAssociateContext
ImmAssociateContextEx
ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmCreateSoftKeyboard
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmDisableIME
ImmDisableIme
ImmDisableLegacyIME
ImmDisableTextFrameService
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeA
ImmEscapeW
ImmFreeLayout
ImmGenerateMessage
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionString
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMCLockCount
ImmGetIMEFileNameA
ImmGetIMEFileNameW
ImmGetImeInfoEx
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmIMPGetIMEA
ImmIMPGetIMEW
ImmIMPQueryIMEA
ImmIMPQueryIMEW
ImmIMPSetIMEA
ImmIMPSetIMEW
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLoadIME
ImmLoadLayout
ImmLockClientImc
ImmLockIMC
ImmLockIMCC
ImmLockImeDpi
ImmNotifyIME
ImmPenAuxInput
ImmProcessKey
ImmPutImeMenuItemsIntoMappedFile
ImmReSizeIMCC
ImmRegisterClient
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSendIMEMessageExA
ImmSendIMEMessageExW
ImmSendMessageToActiveDefImeWndW
ImmSetActiveContext
ImmSetActiveContextConsoleIME
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmSystemHandler
ImmTranslateMessage
ImmUnlockClientImc
ImmUnlockIMC
ImmUnlockIMCC
ImmUnlockImeDpi
ImmUnregisterWordA
ImmUnregisterWordW
ImmWINNLSEnableIME
ImmWINNLSGetEnableStatus
ImmWINNLSGetIMEHotkey
__wine_ime_wnd_proc

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef4365dd976811d458bf80d35676903a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

kernelbase

ntdll

ucrtbase

user32

win32u

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 54KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 952B

.rdata Size: 16KB - Virtual size: 12KB

/4 Size: 4KB - Virtual size: 488B

.pdata Size: 4KB - Virtual size: 3KB

.xdata Size: 4KB - Virtual size: 3KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 936B

.reloc Size: 4KB - Virtual size: 84B

.text
Size: 56KB - Virtual size: 54KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 952B

.rdata
Size: 16KB - Virtual size: 12KB

/4
Size: 4KB - Virtual size: 488B

.pdata
Size: 4KB - Virtual size: 3KB

.xdata
Size: 4KB - Virtual size: 3KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 936B

.reloc
Size: 4KB - Virtual size: 84B