a9aa613cbe100f65fa920979af378c1d8b3590b782eeb5d6f152b105496e6866

Sharing

Copy URL

Twitter E-mail

General

Target

a9aa613cbe100f65fa920979af378c1d8b3590b782eeb5d6f152b105496e6866
Size

97KB
MD5

5fe88c31dfdfa4e764dc8673ad8edbd6
SHA1

a9fe2eb28d0985ea27bebbf86fc187040d865f2f
SHA256

a9aa613cbe100f65fa920979af378c1d8b3590b782eeb5d6f152b105496e6866
SHA512

34ee3462dae3494d6db9ee2bebc48c33eaff15135ed082cdc4efc5ee08570dfd5e783c242d114b48ad83d0c96366f7c61941e5f39facc3338a4f91aab209bfb6
SSDEEP

1536:X9Y9h1T6a2scaUwJqJLjdMko2/2Y46lm6nHQbyocXeyk61uD7:y97+a2szUwJQLjdMZ82Y4SfQbyoWe/D7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9aa613cbe100f65fa920979af378c1d8b3590b782eeb5d6f152b105496e6866

Files

a9aa613cbe100f65fa920979af378c1d8b3590b782eeb5d6f152b105496e6866
.dll windows:4 windows x86 arch:x86

1eab4c3683b49da22d72a76fe8a454b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumValueW
RegGetValueW
RegOpenKeyExW

gdi32

CreateDCA
CreateFontIndirectA
CreateFontIndirectW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
EnumFontFamiliesExW
ExtTextOutW
GetDeviceCaps
GetFontData
GetGlyphOutlineA
GetGraphicsMode
GetStockObject
GetTextMetricsA
GetWorldTransform
Polyline
Rectangle
SelectObject
SetBkMode
SetGraphicsMode
SetTextColor
SetWorldTransform

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__mb_cur_max
_amsg_exit
_errno
_initterm
_iob
_lock
_unlock
abort
atoi
calloc
fputc
free
fwrite
getenv
localeconv
malloc
memcpy
memset
realloc
setlocale
strchr
strerror
strlen
strncmp
vfprintf
wcscmp
wcscpy
wcslen
wcsstr

user32

SystemParametersInfoA

libgcc_s_dw2-1

__udivdi3
__umoddi3

libglib-2.0-0

g_ascii_strcasecmp
g_ascii_strdown
g_convert
g_direct_equal
g_direct_hash
g_free
g_hash_table_destroy
g_hash_table_foreach
g_hash_table_insert
g_hash_table_lookup
g_hash_table_new
g_hash_table_new_full
g_hash_table_remove
g_intern_static_string
g_list_foreach
g_list_free
g_list_free_1
g_list_prepend
g_locale_to_utf8
g_log_structured_standard
g_malloc
g_malloc0
g_malloc_n
g_once_init_enter
g_once_init_leave
g_print
g_private_get
g_private_set
g_queue_delete_link
g_queue_find
g_queue_free
g_queue_new
g_queue_pop_tail
g_queue_push_head
g_realloc
g_return_if_fail_warning
g_slice_alloc
g_slice_free1
g_slist_append
g_slist_foreach
g_slist_free
g_slist_free_full
g_slist_length
g_slist_prepend
g_slist_remove
g_str_equal
g_str_hash
g_strdup
g_strfreev
g_string_append
g_string_append_printf
g_string_assign
g_string_free
g_string_new
g_string_truncate
g_strsplit
g_utf16_to_utf8
g_win32_error_message

libgobject-2.0-0

g_object_new
g_object_ref
g_object_remove_weak_pointer
g_object_unref
g_type_check_class_cast
g_type_check_instance_cast
g_type_check_instance_is_a
g_type_class_adjust_private_offset
g_type_class_peek_parent
g_type_register_static_simple
g_weak_ref_get
g_weak_ref_set

libharfbuzz-0

hb_blob_create
hb_blob_get_empty
hb_face_collect_unicodes
hb_face_create_for_tables
hb_face_destroy
hb_font_create
hb_font_get_face
hb_font_get_nominal_glyph
hb_font_set_scale
hb_set_create
hb_set_next

libpango-1.0-0

pango_context_set_font_description
pango_context_set_language
pango_coverage_get
pango_coverage_new
pango_coverage_ref
pango_coverage_set
pango_coverage_unref
pango_font_describe_with_absolute_size
pango_font_description_better_match
pango_font_description_copy
pango_font_description_copy_static
pango_font_description_free
pango_font_description_get_family
pango_font_description_get_size
pango_font_description_get_size_is_absolute
pango_font_description_get_style
pango_font_description_get_weight
pango_font_description_new
pango_font_description_set_absolute_size
pango_font_description_set_family
pango_font_description_set_family_static
pango_font_description_set_size
pango_font_description_set_stretch
pango_font_description_set_style
pango_font_description_set_variant
pango_font_description_set_weight
pango_font_description_to_string
pango_font_description_unset_fields
pango_font_face_describe
pango_font_face_get_type
pango_font_family_get_type
pango_font_get_hb_font
pango_font_get_type
pango_font_map_create_context
pango_font_map_get_type
pango_font_metrics_new
pango_font_metrics_ref
pango_font_metrics_unref
pango_fontset_get_type
pango_fontset_simple_append
pango_fontset_simple_new
pango_fontset_simple_size
pango_glyph_string_extents
pango_language_get_sample_string
pango_layout_get_iter
pango_layout_get_lines_readonly
pango_layout_get_type
pango_layout_iter_free
pango_layout_iter_get_baseline
pango_layout_iter_get_line_extents
pango_layout_iter_get_line_readonly
pango_layout_iter_next_line
pango_layout_line_get_extents
pango_layout_new
pango_layout_set_text
pango_scan_string
pango_skip_space

Exports

Exports

_pango_win32_font_get_hfont
_pango_win32_font_get_type
_pango_win32_font_map_get_type
_pango_win32_fontmap_cache_remove
_pango_win32_get_display_dc
_pango_win32_make_matching_logfontw
pango_win32_font_cache_free
pango_win32_font_cache_load
pango_win32_font_cache_loadw
pango_win32_font_cache_new
pango_win32_font_cache_unload
pango_win32_font_description_from_logfont
pango_win32_font_description_from_logfontw
pango_win32_font_done_font
pango_win32_font_get_glyph_index
pango_win32_font_get_metrics_factor
pango_win32_font_logfont
pango_win32_font_logfontw
pango_win32_font_map_for_display
pango_win32_font_map_get_font_cache
pango_win32_font_select_font
pango_win32_get_context
pango_win32_get_dc
pango_win32_get_debug_flag
pango_win32_get_unknown_glyph
pango_win32_render
pango_win32_render_layout
pango_win32_render_layout_line
pango_win32_render_transformed
pango_win32_shutdown_display

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1eab4c3683b49da22d72a76fe8a454b2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

user32

libgcc_s_dw2-1

libglib-2.0-0

libgobject-2.0-0

libharfbuzz-0

libpango-1.0-0

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 52KB

.data Size: 512B - Virtual size: 92B

.rdata Size: 8KB - Virtual size: 7KB

/4 Size: 11KB - Virtual size: 10KB

.bss Size: - Virtual size: 2KB

.edata Size: 1KB - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 53KB - Virtual size: 52KB

.data
Size: 512B - Virtual size: 92B

.rdata
Size: 8KB - Virtual size: 7KB

/4
Size: 11KB - Virtual size: 10KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 3KB - Virtual size: 2KB