9ec58377f3093bb7f525a696c54f4f37d2868d0065cdad6b2e79934e059e77f6

Sharing

Copy URL Twitter E-mail

General

Target

9ec58377f3093bb7f525a696c54f4f37d2868d0065cdad6b2e79934e059e77f6
Size

968KB
MD5

5aa8307cf898d36c862df732753fcde0
SHA1

cb2767b1b2097ce3aecad6c44652c7c6a161cd49
SHA256

9ec58377f3093bb7f525a696c54f4f37d2868d0065cdad6b2e79934e059e77f6
SHA512

333347cf7ef6fd0620fe4ae1498445af4249790b7fb052cc9bbe8011c2a3e79af3f58ea0e18d63b7c1987cee7351f037f701ba5dd6c22bc5b208c436aec0a91e
SSDEEP

768:4ohu2HobBGH1kPtHAct71Ix674yYlmoPn2R+6ykzp04GKbqB4cgjLm9Zl/inYI5I:phuIfHCdASX7c5wpHbm9riOUa5lI7M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ec58377f3093bb7f525a696c54f4f37d2868d0065cdad6b2e79934e059e77f6

Files

9ec58377f3093bb7f525a696c54f4f37d2868d0065cdad6b2e79934e059e77f6
.dll windows:6 windows x64 arch:x64

709ef95fc7f2757a4736822a17cb7871

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memchr
_CxxThrowException
_onexit
__dllonexit
memcpy
_lock
memset
_initterm
??_V@YAXPEAX@Z
_wcsicmp
memmove
memcmp
__CxxFrameHandler3
malloc
free
_amsg_exit
_XcptFilter
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
?terminate@@YAXXZ
_callnewh
_purecall
__C_specific_handler
_unlock
_aligned_offset_malloc
_aligned_free
realloc
swprintf_s
wcscpy_s
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf
memcpy_s
_vsnprintf_s
??0exception@@QEAA@XZ
memmove_s
sqrt

api-ms-win-core-synch-l1-2-0

Sleep
WakeByAddressAll
WaitOnAddress
InitOnceExecuteOnce

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
RtlCaptureStackBackTrace

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

TlsFree
OpenProcessToken
SetThreadPriority
TlsGetValue
GetThreadPriority
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
TlsSetValue
OpenThreadToken
TlsAlloc
CreateThread
OpenThread
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
FreeLibrary

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
CreateWaitableTimerExW
InitializeSRWLock
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
ReleaseMutex
ReleaseSemaphore
SetWaitableTimer
WaitForSingleObjectEx
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapCreate
HeapSize
HeapDestroy
HeapFree
HeapAlloc

api-ms-win-core-handle-l1-1-0

GetHandleInformation
DuplicateHandle
CloseHandle

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-localization-l1-2-0

LCMapStringW
FormatMessageW
GetLocaleInfoW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
WriteFile
ReadFile

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

ws2_32

WSAIoctl
listen
setsockopt
closesocket
WSASocketW
WSACleanup
WSAStartup
bind

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-interlocked-l1-1-0

QueryDepthSList
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
InterlockedPopEntrySList

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery

api-ms-win-security-base-l1-1-0

RevertToSelf
GetTokenInformation

api-ms-win-core-localization-obsolete-l1-2-0

GetNumberFormatW

ntdll

NtAlpcQueryInformation
NtAlpcAcceptConnectPort
NtAlpcCreatePort
RtlInitUnicodeString
NtAlpcDisconnectPort
NtAllocateReserveObject
NtRemoveIoCompletionEx
NtSetIoCompletionEx
NtAssociateWaitCompletionPacket
NtCreateIoCompletion
NtAlpcConnectPortEx
NtAlpcImpersonateClientOfPort
RtlClearThreadWorkOnBehalfTicket
RtlSetThreadWorkOnBehalfTicket
AlpcGetMessageAttribute
NtAlpcSendWaitReceivePort
NtClose
NtCancelWaitCompletionPacket
NtCreateWaitCompletionPacket
RtlFreeUnicodeString
RtlGetAppContainerNamedObjectPath
NtQuerySystemInformation
AlpcInitializeMessageAttribute

api-ms-win-security-accesshlpr-l1-1-0

FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

Exports

Exports

CoreUICallComputeMaximumMessageSize
CoreUICallCreateConversationHost
CoreUICallCreateEndpointHost
CoreUICallCreateEndpointHostWithSendPriority
CoreUICallGetAddressOfParameterInBuffer
CoreUICallReceive
CoreUICallSend
CoreUICallSendVaList
CoreUIConfigureTestHost
CoreUIConfigureUserIntegration
CoreUICreate
CoreUICreateAnonymousStream
CoreUICreateClientWindowIDManager
CoreUICreateEx
CoreUICreateSystemWindowIDManager
CoreUIInitializeTestService
CoreUIOpenExisting
CoreUIRouteToTestRegistrar
CoreUIUninitializeTestService
CreateDispatcherQueueController
CreateDispatcherQueueForCurrentThread
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetDispatcherQueueForCurrentThread
MsgBlobCreateShared
MsgBlobCreateStack
MsgBufferShare
MsgRelease
MsgStringCreateShared
MsgStringCreateStack
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

709ef95fc7f2757a4736822a17cb7871

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

ws2_32

api-ms-win-core-io-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

api-ms-win-security-accesshlpr-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-apiquery-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-util-l1-1-0

Exports

Exports

Sections

.text Size: 596KB - Virtual size: 596KB

.rdata Size: 228KB - Virtual size: 228KB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 56KB - Virtual size: 56KB

.didat Size: 4KB - Virtual size: 4KB

.rsrc Size: 56KB - Virtual size: 56KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 596KB - Virtual size: 596KB

.rdata
Size: 228KB - Virtual size: 228KB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 56KB - Virtual size: 56KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 56KB - Virtual size: 56KB

.reloc
Size: 12KB - Virtual size: 12KB