827ae5a107a74fcd52675c825ba44b2c5ba82c5a88b22fd5a37ce7415ab55123

Sharing

Copy URL

Twitter E-mail

General

Target

827ae5a107a74fcd52675c825ba44b2c5ba82c5a88b22fd5a37ce7415ab55123
Size

1.5MB
MD5

ef21c4438bd5f953e2e507f3211ba159
SHA1

298e6c4a5b514f8ea2f748f9daaa6ce578b6e029
SHA256

827ae5a107a74fcd52675c825ba44b2c5ba82c5a88b22fd5a37ce7415ab55123
SHA512

29c4d9aeb173473e58683a4b9b50b5d56b0dcb55be3e225a53522413f03b124e1ad60496b91f97d22a138103dc42cc183b51189268bfba8379269e30c22c9188
SSDEEP

24576:zWLCWMAfPx+InYHAUQCIk/0ANuVOw9OHhZj/1c+4xPTmTl/////GuxpmGqlrEH7M:zW5r+IYZQQwOK0hZCHKEuyRvD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
827ae5a107a74fcd52675c825ba44b2c5ba82c5a88b22fd5a37ce7415ab55123

Files

827ae5a107a74fcd52675c825ba44b2c5ba82c5a88b22fd5a37ce7415ab55123
.dll regsvr32 windows:10 windows x86 arch:x86

a9b687d5c8016492c5b429eb6e959a02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

quartz.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtoi
_o_atoi
_o_free
_o_malloc
_o_wcscpy_s
_o_wcsncat_s
_except_handler4_common
_o__execute_onexit_table
_o__crt_atexit
_o__configure_narrow_argv
_o__CIsqrt
_o__CIcos
_o__cexit
_o__callnewh
_o__aligned_malloc
_o__aligned_free
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
__std_terminate
__CxxFrameHandler3
wcschr
wcsrchr
_CxxThrowException
memchr
memcmp
_o_calloc

api-ms-win-crt-string-l1-1-0

memset
strnlen
wcsnlen

kernel32

WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
DelayLoadFailureHook
ResolveDelayLoadedAPI
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcmpiW
GetFileType
MapViewOfFileEx
GetLastError
CreateFileW
SetFilePointer
lstrlenW
ReadFile
FormatMessageA
GetModuleFileNameA
FormatMessageW
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
CompareStringW
CloseHandle
GetCurrentProcessId
lstrcmpA
LocalReAlloc
LocalLock
LocalUnlock
GetDriveTypeW
GetFileSize
GetDiskFreeSpaceW
LoadLibraryExA
SetErrorMode
CreateSemaphoreW
WriteProfileStringW
GetProcessHeap
HeapAlloc
HeapFree
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GlobalHandle
GetProfileStringA
GetPrivateProfileStringA
CompareStringA
GetProfileIntW
LoadLibraryExW
MulDiv
GetShortPathNameA
GetExitCodeProcess
MapViewOfFile
CreateFileMappingW
lstrcmpiA
LocalFree
OpenProcess
GetACP
UnmapViewOfFile
LocalAlloc
lstrlenA
WaitForMultipleObjects
GetTempPath2W
GetFileInformationByHandle
WriteFile
GetFullPathNameW
QueryPerformanceFrequency
ReleaseMutex
CreateMutexW
WideCharToMultiByte
HeapDestroy
RaiseException
FreeLibrary
LoadLibraryW
Sleep
FreeLibraryAndExitThread
GetCurrentThread
GetThreadPriority
GetTickCount
SetThreadPriority
CreateThread
GetVersionExW
DisableThreadLibraryCalls
VirtualFree
VirtualAlloc
GetSystemInfo
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
WaitForMultipleObjectsEx
SetEvent
DuplicateHandle
ResetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
lstrcmpW
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId

gdi32

RealizePalette
BitBlt
GetStockObject
CreatePalette
CreateRectRgnIndirect
SelectPalette
CombineRgn
FillRgn
SetPixel
GetSystemPaletteEntries
GdiFlush
GetClipBox
GetPixel
SetDIBColorTable
CreateDCA
ExtTextOutW
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
PatBlt
GetDIBits
DeleteDC
CreateSolidBrush
CreateFontIndirectW
GetDCOrgEx
EqualRgn
ExtCreateRegion
CreateRectRgn
DeleteObject
SetBkColor
CreateDIBSection
EnumFontFamiliesExW
GetTextExtentPoint32W
SetTextColor
SetBkMode
SetTextCharacterExtra
StretchDIBits
SetDIBitsToDevice
GetObjectW
StretchBlt
SetStretchBltMode
CreateDCW
GetDeviceCaps

user32

InvalidateRect
SetForegroundWindow
CharNextW
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
GetQueueStatus
RegisterWindowMessageW
PostThreadMessageW
TranslateMessage
ReplyMessage
PostMessageW
GetMessageW
ReleaseDC
GetDC
LoadStringW
GetWindowThreadProcessId
SendMessageW
KillTimer
SetTimer
InSendMessage
IsWindow
GetMonitorInfoW
MonitorFromWindow
SetRect
IsRectEmpty
GetSystemMetrics
EqualRect
IsWindowVisible
DialogBoxParamW
GetDlgItem
SendDlgItemMessageW
EndDialog
SystemParametersInfoW
MessageBoxW
GetWindowRect
AdjustWindowRectEx
DefWindowProcW
GetClassInfoW
UnregisterClassW
LoadCursorW
RegisterClassW
CreateWindowExW
SetRectEmpty
GetForegroundWindow
CreateDialogParamW
DestroyWindow
SetDlgItemTextW
EnableWindow
SetWindowPos
SetWindowTextW
ShowWindow
MoveWindow
SetParent
SetWindowLongW
IsZoomed
GetWindowTextW
FillRect
OffsetRect
GetAncestor
GetMonitorInfoA
ChangeDisplaySettingsExW
EnumDisplayMonitors
EnumDisplayDevicesW
DestroyCursor
SetCursor
GetClientRect
LoadImageW
BeginPaint
EndPaint
GetWindowLongW
MonitorFromRect
GetWindowPlacement
ChangeDisplaySettingsExA
GetDesktopWindow
GetParent
IsIconic
ScreenToClient
ClientToScreen
MapWindowPoints
IntersectRect

advapi32

OpenThreadToken
RegEnumValueW
RegDeleteValueW
EventUnregister
RegOpenKeyExW
RegEnumKeyExW
EventSetInformation
RegDeleteKeyW
EventRegister
RegCloseKey
EventWriteTransfer
RegCreateKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
EventEnabled
RegGetValueW
GetTokenInformation
GetLengthSid
GetKernelObjectSecurity
OpenProcessToken
IsValidSid
RegEnumKeyW
RegOpenKeyW
RegFlushKey
RegQueryValueExA
RegQueryValueW
EqualSid
CopySid
GetSecurityDescriptorOwner
RegQueryValueExW

ole32

StringFromCLSID
MkParseDisplayName
CoGetMalloc
CoGetClassObject
CoCreateFreeThreadedMarshaler
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx
CLSIDFromString
StringFromGUID2
CoCreateInstance
StgIsStorageFile
StgOpenStorage
IIDFromString
CoTaskMemRealloc

oleaut32

RegisterTypeLi
SysFreeString
LoadTypeLi
SysAllocString
LoadRegTypeLi
VariantClear
SafeArrayAccessData
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen
VariantCopy
VariantInit
SetErrorInfo
SysReAllocString

winmm

timeEndPeriod
timeGetDevCaps
timeBeginPeriod
timeGetTime
timeSetEvent
timeKillEvent
midiOutGetErrorTextW
mixerGetNumDevs
midiOutPrepareHeader
mixerSetControlDetails
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
midiStreamPause
midiStreamClose
mixerGetLineInfoW
midiStreamOut
mixerGetDevCapsW
mixerGetControlDetailsW
midiStreamPosition
midiOutGetNumDevs
midiStreamRestart
mixerGetLineControlsW
midiOutReset
waveOutGetPosition
waveOutPrepareHeader
waveOutOpen
waveOutPause
waveOutGetVolume
waveOutReset
waveOutRestart
waveOutClose
waveOutUnprepareHeader
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutSetVolume
waveOutGetErrorTextW
waveOutWrite

api-ms-win-shell-shellfolders-l1-1-0

SHGetFolderPathW

shlwapi

PathFindFileNameW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx
GetLocalTime

bcrypt

BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptImportKeyPair
BCryptDestroyKey
BCryptVerifySignature
BCryptGetProperty

msvcp_win

?_Xlength_error@std@@YAXPBD@Z

ntdll

RtlNtStatusToDosError
RtlGetPersistedStateLocation

Exports

Exports

AMGetErrorTextA
AMGetErrorTextW
AmpFactorToDB
DBToAmpFactor
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9b687d5c8016492c5b429eb6e959a02

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

gdi32

user32

advapi32

ole32

oleaut32

winmm

api-ms-win-shell-shellfolders-l1-1-0

shlwapi

api-ms-win-core-io-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

bcrypt

msvcp_win

ntdll

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 27KB - Virtual size: 218KB

.idata Size: 11KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 42KB - Virtual size: 41KB

.reloc Size: 71KB - Virtual size: 71KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 27KB - Virtual size: 218KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 42KB - Virtual size: 41KB

.reloc
Size: 71KB - Virtual size: 71KB