bdedd68761e9f20b43e2486639c5ca68902fed57ad31c2e5904b2de57ea19155

Sharing

Copy URL Twitter E-mail

General

Target

bdedd68761e9f20b43e2486639c5ca68902fed57ad31c2e5904b2de57ea19155
Size

369KB
MD5

1162541db38ee5268a3a786ccb3b3015
SHA1

199516f5e4f47cb720b581919116342d876deaa9
SHA256

bdedd68761e9f20b43e2486639c5ca68902fed57ad31c2e5904b2de57ea19155
SHA512

061a69eb756082ef339ddf970f93107166ed37f54d00b1c64c87aa5b0a9ae67852f5dc8e72070d8c1f817b48cad25a9ad8aad03867653f6130b420e2aaf4303a
SSDEEP

6144:/8u7cWETRoRaQmThUIBa0c5NA1QoTi/JwNQXZiXZl+zl:rZeaRga0BNTi/JwNQp6W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdedd68761e9f20b43e2486639c5ca68902fed57ad31c2e5904b2de57ea19155

Files

bdedd68761e9f20b43e2486639c5ca68902fed57ad31c2e5904b2de57ea19155
.dll windows:5 windows x86 arch:x86

e5362c1da79473cca717399f974f6d50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROXI\PCFax\UI\FaxSettingWizard\2k\Release\ENGLISH\R7EXWZD.pdb

Imports

kernel32

HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
Sleep
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
HeapFree
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
InterlockedIncrement
GlobalFlags
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
InterlockedExchange
lstrlenA
lstrcmpA
GetModuleHandleA
GlobalAlloc
FormatMessageW
LocalFree
GlobalFree
InterlockedDecrement
GetModuleFileNameW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
GetVersionExA
LoadLibraryA
ExpandEnvironmentStringsA
MulDiv
GetProcAddress
SetLastError
GetLastError
WritePrivateProfileStringW
GetTimeFormatW
WriteFile
GetModuleHandleW
GetDateFormatW
lstrcmpW
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
FreeLibrary
CloseHandle
CreateFileW
ReadFile
WideCharToMultiByte
GlobalUnlock
GlobalLock
GetVersionExW
LockResource
GetLocalTime
SizeofResource
LoadResource
FindResourceW
MultiByteToWideChar
lstrcpyW
lstrcatW
GetFileType
lstrlenW

user32

GetWindowThreadProcessId
SetCursor
PostQuitMessage
EndPaint
BeginPaint
ClientToScreen
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
DestroyMenu
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetMenu
SetForegroundWindow
IsWindowVisible
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindow
UpdateWindow
SendMessageW
GetSysColor
InvalidateRect
GetParent
SetTimer
ScreenToClient
FillRect
TabbedTextOutW
GetFocus
ChildWindowFromPointEx
IsWindowEnabled
DrawTextExW
PtInRect
GetIconInfo
GetCapture
DrawFocusRect
InflateRect
OffsetRect
DrawStateW
LoadCursorW
GrayStringW
IsWindow
DrawFrameControl
PostMessageW
GetSysColorBrush
UnregisterClassW
GetMessageW
TranslateMessage
GetWindowTextW
ValidateRect
KillTimer
GetCursorPos
WindowFromPoint
GetSubMenu
GetWindowRect
wsprintfW
EnableWindow
GetDlgItem
GetSystemMetrics
ReleaseDC
GetDC
GetClientRect
DrawTextW
LoadImageW
SetParent
IsZoomed
GetWindowLongW
SetWindowLongW
CopyRect
GetWindowDC
GetKeyState
LoadBitmapW
MessageBoxW
LoadIconW
IsIconic
GetForegroundWindow

gdi32

SetWindowExtEx
ScaleWindowExtEx
GetStockObject
ScaleViewportExtEx
SetWindowOrgEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
IntersectClipRect
TextOutW
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateFontW
BitBlt
GetDIBits
CreateBitmap
CreateCompatibleBitmap
ExtTextOutW
PtVisible
StretchDIBits
Escape
RectVisible
GetPixel
CreateSolidBrush
PatBlt
DeleteObject
GetDeviceCaps
MoveToEx
GetTextExtentPoint32W
LineTo
DeleteDC
CreateFontIndirectW
StretchBlt
SetBkMode
SelectObject
CreateCompatibleDC
SetMapMode
Rectangle
GetObjectW
CreatePen
SetTextAlign

msimg32

AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegQueryValueW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

comctl32

ord17
ImageList_Add
ImageList_Create

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

mydll

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5362c1da79473cca717399f974f6d50

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 235KB - Virtual size: 234KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 13KB - Virtual size: 38KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 38KB - Virtual size: 38KB

.text
Size: 235KB - Virtual size: 234KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 13KB - Virtual size: 38KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 38KB - Virtual size: 38KB