c376ff5df203657a0ade7afd7ab65c87f24bf3292e0bc93dc0d2240b216670ab

Sharing

Copy URL Twitter E-mail

General

Target

c376ff5df203657a0ade7afd7ab65c87f24bf3292e0bc93dc0d2240b216670ab
Size

1.0MB
MD5

aff8cff66a555dab88eaeaf9a383e7db
SHA1

62ed54d7d9ee62df63bc99c080a19b705aa7b3eb
SHA256

c376ff5df203657a0ade7afd7ab65c87f24bf3292e0bc93dc0d2240b216670ab
SHA512

0d6dd0f6cfe5356143c27bc53b236c77c0b25abff5876ab01effb3ef632f2852ffdbe94ce3b4500a1d169699c119b8fe99a5c5b6595218158a9cbc8a09a09c35
SSDEEP

24576:aok43bYzRTlahIzYlh4V+9h14dRiUhB6OO/xH7r4:a4UzRTlahIM4RgkjO4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c376ff5df203657a0ade7afd7ab65c87f24bf3292e0bc93dc0d2240b216670ab

Files

c376ff5df203657a0ade7afd7ab65c87f24bf3292e0bc93dc0d2240b216670ab
.dll windows:5 windows x86 arch:x86

6690523a0e2067e9c33d9357ee9b5b2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\gilisoftdll\hlm\bin\release\hlm.pdb

Imports

kernel32

GetDriveTypeW
MultiByteToWideChar
GetVersionExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoW
GetSystemDirectoryW
VerSetConditionMask
WaitForSingleObject
FormatMessageA
SleepEx
InitializeCriticalSection
ReadConsoleW
SetEndOfFile
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
HeapDestroy
FindClose
GetConsoleMode
GetConsoleCP
SystemTimeToTzSpecificLocalTime
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
LoadLibraryExW
FreeLibrary
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetFullPathNameW
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedDecrement
InterlockedIncrement
GetLocalTime
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
SetFileTime
SetFilePointer
WriteFile
GetFileType
GetCurrentProcess
MulDiv
ExitProcess
CreateFileW
FindResourceW
CloseHandle
ReadFile
GetFileSize
SizeofResource
LoadResource
LockResource
FreeResource
GetCurrentDirectoryW
GetModuleHandleW
LoadLibraryW
GetTickCount
GetProcAddress
GetACP
DeleteFileA
GetTempPathA
GetModuleFileNameW
CreateDirectoryA
WideCharToMultiByte
CreateDirectoryW
WritePrivateProfileStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
SetLastError
EncodePointer
LeaveCriticalSection
EnterCriticalSection
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
EnumSystemLocalesW
Sleep
DecodePointer
FindFirstFileExA
DeleteFileW
GetFileAttributesExW

user32

UnionRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
IsWindow
IsWindowVisible
IsIconic
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
ReleaseDC
BeginPaint
EndPaint
SetCursor
InvalidateRect
GetClientRect
GetWindowRect
PostMessageW
ScreenToClient
MapWindowPoints
IntersectRect
IsRectEmpty
PtInRect
GetParent
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
SetPropW
GetPropW
wvsprintfW
GetWindow
GetUpdateRect
SetFocus
wsprintfW
SetWindowLongW
GetWindowLongW
GetDC
KillTimer
AttachThreadInput
ShowWindow
GetForegroundWindow
SetForegroundWindow
GetWindowThreadProcessId
UnregisterClassW
DestroyWindow
MonitorFromWindow
SetTimer
SetWindowPos
GetCursorPos
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetSysColor
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
GetGUIThreadInfo
ClientToScreen
InvalidateRgn
CreateAcceleratorTableW
GetWindowRgn
MoveWindow
MessageBoxW
SetWindowRgn
IsZoomed
SetRect
FillRect
DrawTextW
CharPrevW
GetMonitorInfoW

gdi32

BitBlt
CreateCompatibleBitmap
CreatePatternBrush
GetDeviceCaps
GetObjectA
PtInRegion
CreateRectRgn
GdiFlush
ExtTextOutW
TextOutW
MoveToEx
CreateDIBSection
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC

shell32

SHGetSpecialFolderPathA
ShellExecuteA
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateGuid
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoInitialize

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdiplus

GdipDisposeImage
GdipCloneImage
GdipGetFamily
GdipGetImageGraphicsContext
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipGetImageHeight
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipGraphicsClear
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipCreateFromHDC
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipFree
GdipGetPropertyItemSize
GdipGetPropertyItem

shlwapi

PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW

comctl32

ord17
_TrackMouseEvent

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmSetCompositionFontW
ImmGetContext

advapi32

CryptCreateHash
CryptEncrypt
CryptImportKey
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptDestroyKey

ws2_32

__WSAFDIsSet
ntohl
htonl
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
WSAGetLastError
WSACleanup
WSAStartup

wldap32

ord301
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord118
ord41
ord208
ord73
ord216
ord14
ord46
ord145
ord147

crypt32

CertFreeCertificateContext

Exports

Exports

hudun_authenticate
hudun_get_license
hudun_limit
hudun_logout
hudun_open_aboutus_website
hudun_open_buy_website
hudun_open_feedback_website
hudun_open_hotline_website

Sections

.text
Size: 833KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6690523a0e2067e9c33d9357ee9b5b2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

gdiplus

shlwapi

comctl32

imm32

advapi32

ws2_32

wldap32

crypt32

Exports

Exports

Sections

.text Size: 833KB - Virtual size: 832KB

.rdata Size: 185KB - Virtual size: 185KB

.data Size: 8KB - Virtual size: 16KB

.gfids Size: 512B - Virtual size: 384B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024B - Virtual size: 736B

.reloc Size: 43KB - Virtual size: 43KB

.text
Size: 833KB - Virtual size: 832KB

.rdata
Size: 185KB - Virtual size: 185KB

.data
Size: 8KB - Virtual size: 16KB

.gfids
Size: 512B - Virtual size: 384B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 43KB - Virtual size: 43KB