00fd859b988a8d0c9fd8b938fd8ccbf76f8075ce0fb0be704efa3484e8649e5e

Sharing

Copy URL Twitter E-mail

General

Target

00fd859b988a8d0c9fd8b938fd8ccbf76f8075ce0fb0be704efa3484e8649e5e
Size

166KB
MD5

91409b5fc71933c2bf04d3d825000113
SHA1

1c6d5b607694e20acf88bd59266c03f2990cc8ab
SHA256

00fd859b988a8d0c9fd8b938fd8ccbf76f8075ce0fb0be704efa3484e8649e5e
SHA512

406d5d1a9cba57b2e12b3a2bce3c4c2357aff910d723d405f83048071a27ea6878162d9686a95e5ad215f97f827bf91cf395cf66e71ba82176ca9b22198dfc9a
SSDEEP

3072:xEhs+aGBVQAFg6BBJa8/RI6Wo9Ag6+J5hAQQU7kpTAHluobjrNr66ExbJtyM:ehKIPBBJa8/RI6N685hAQQU7kpTAHluB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00fd859b988a8d0c9fd8b938fd8ccbf76f8075ce0fb0be704efa3484e8649e5e

Files

00fd859b988a8d0c9fd8b938fd8ccbf76f8075ce0fb0be704efa3484e8649e5e
.dll windows:4 windows x86 arch:x86

70647984989fff4ae335e682ae6d0238

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libcrypto-1_1

BN_bin2bn
BN_clear_free
BN_free
CRYPTO_get_ex_new_index
DSA_SIG_free
DSA_SIG_new
DSA_SIG_set0
DSA_free
DSA_get_default_method
DSA_get_ex_data
DSA_meth_dup
DSA_meth_free
DSA_meth_set1_name
DSA_meth_set_sign
DSA_set_ex_data
DSA_set_method
ECDSA_SIG_free
ECDSA_SIG_new
ECDSA_SIG_set0
EC_KEY_METHOD_free
EC_KEY_METHOD_get_sign
EC_KEY_METHOD_new
EC_KEY_METHOD_set_sign
EC_KEY_free
EC_KEY_get_default_method
EC_KEY_get_ex_data
EC_KEY_set_ex_data
EC_KEY_set_method
EVP_PKEY_free
EVP_PKEY_get1_DSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_id
RSA_free
RSA_get_default_method
RSA_get_ex_data
RSA_meth_dup
RSA_meth_free
RSA_meth_set1_name
RSA_meth_set_flags
RSA_meth_set_priv_dec
RSA_meth_set_priv_enc
RSA_set_ex_data
RSA_set_method
RSA_size
X509_NAME_cmp
X509_NAME_oneline
X509_cmp_current_time
X509_dup
X509_free
X509_get0_notAfter
X509_get0_notBefore
X509_get_issuer_name
X509_get_pubkey
X509_get_subject_name
X509_new
X509_verify
d2i_X509

kernel32

CloseHandle
CreateEventA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FreeLibrary
GetLastError
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
ReleaseMutex
SetEvent
Sleep
SystemTimeToTzSpecificLocalTime
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

__mb_cur_max
_amsg_exit
_assert
_beginthreadex
_errno
_initterm
_iob
_lock
time
localtime
mktime
gmtime
_unlock
abort
asctime
atoi
calloc
fputc
free
fwrite
getc
getenv
isgraph
islower
isspace
isupper
isxdigit
localeconv
malloc
memcpy
memmove
memset
realloc
setlocale
strchr
strcmp
strerror
strlen
strncat
strncmp
strncpy
strrchr
strtol
strtoul
tolower
ungetc
vfprintf
wcslen

libgcc_s_sjlj-1

__divdi3
__udivdi3
__umoddi3

Exports

Exports

pkcs11h_addProvider
pkcs11h_certificate_create
pkcs11h_certificate_decrypt
pkcs11h_certificate_decryptAny
pkcs11h_certificate_deserializeCertificateId
pkcs11h_certificate_duplicateCertificateId
pkcs11h_certificate_ensureCertificateAccess
pkcs11h_certificate_ensureKeyAccess
pkcs11h_certificate_enumCertificateIds
pkcs11h_certificate_enumTokenCertificateIds
pkcs11h_certificate_freeCertificate
pkcs11h_certificate_freeCertificateId
pkcs11h_certificate_freeCertificateIdList
pkcs11h_certificate_getCertificateBlob
pkcs11h_certificate_getCertificateId
pkcs11h_certificate_getPromptMask
pkcs11h_certificate_getUserData
pkcs11h_certificate_lockSession
pkcs11h_certificate_releaseSession
pkcs11h_certificate_serializeCertificateId
pkcs11h_certificate_setCertificateIdCertificateBlob
pkcs11h_certificate_setPromptMask
pkcs11h_certificate_setUserData
pkcs11h_certificate_sign
pkcs11h_certificate_signAny
pkcs11h_certificate_signRecover
pkcs11h_certificate_unwrap
pkcs11h_data_del
pkcs11h_data_enumDataObjects
pkcs11h_data_freeDataIdList
pkcs11h_data_get
pkcs11h_data_put
pkcs11h_engine_setCrypto
pkcs11h_engine_setSystem
pkcs11h_forkFixup
pkcs11h_getFeatures
pkcs11h_getLogLevel
pkcs11h_getMessage
pkcs11h_getVersion
pkcs11h_initialize
pkcs11h_logout
pkcs11h_openssl_createSession
pkcs11h_openssl_freeSession
pkcs11h_openssl_getCleanupHook
pkcs11h_openssl_getX509
pkcs11h_openssl_session_getEVP
pkcs11h_openssl_session_getRSA
pkcs11h_openssl_session_getX509
pkcs11h_openssl_setCleanupHook
pkcs11h_plugAndPlay
pkcs11h_removeProvider
pkcs11h_setForkMode
pkcs11h_setLogHook
pkcs11h_setLogLevel
pkcs11h_setMaxLoginRetries
pkcs11h_setPINCachePeriod
pkcs11h_setPINPromptHook
pkcs11h_setProtectedAuthentication
pkcs11h_setSlotEventHook
pkcs11h_setTokenPromptHook
pkcs11h_terminate
pkcs11h_token_deserializeTokenId
pkcs11h_token_duplicateTokenId
pkcs11h_token_ensureAccess
pkcs11h_token_enumTokenIds
pkcs11h_token_freeTokenId
pkcs11h_token_freeTokenIdList
pkcs11h_token_login
pkcs11h_token_logout
pkcs11h_token_sameTokenId
pkcs11h_token_serializeTokenId

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70647984989fff4ae335e682ae6d0238

Headers

DLL Characteristics

File Characteristics

Imports

libcrypto-1_1

kernel32

msvcrt

libgcc_s_sjlj-1

Exports

Exports

Sections

.text Size: 117KB - Virtual size: 117KB

.data Size: 512B - Virtual size: 144B

.rdata Size: 26KB - Virtual size: 26KB

.bss Size: - Virtual size: 2KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 117KB - Virtual size: 117KB

.data
Size: 512B - Virtual size: 144B

.rdata
Size: 26KB - Virtual size: 26KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB