3e425a4b1dc962348b94e1dd885d02cc6f6bc836e087a0198f357923d32111e0

Sharing

Copy URL Twitter E-mail

General

Target

3e425a4b1dc962348b94e1dd885d02cc6f6bc836e087a0198f357923d32111e0
Size

540KB
MD5

40af6321d9b20cfcaca28c14b826afce
SHA1

44ef6f7bf974a71d7cadcaafad6a1fbd41f47050
SHA256

3e425a4b1dc962348b94e1dd885d02cc6f6bc836e087a0198f357923d32111e0
SHA512

876dc3f934c9e70bb96b0810891be12564cd62b97ee406b47258ddfe9859d29d41afe5d98628c99fde41b98168aa502dde6df8d4e70de3590f4672f26b0e8097
SSDEEP

6144:A5HUdQfOUzSkX+2kCCZ3ys+e/6aWtObLtdR2STi4Bm1LGBQ/h1CkSqRI5s:S9r2kX9k3lys+j4RHQ/OqRI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e425a4b1dc962348b94e1dd885d02cc6f6bc836e087a0198f357923d32111e0

Files

3e425a4b1dc962348b94e1dd885d02cc6f6bc836e087a0198f357923d32111e0
.dll windows:10 windows x86 arch:x86

e6053ad9f693649f95930ffd02707b18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gpedit.pdb

Imports

msvcrt

_ftol2_sse
__CxxFrameHandler3
memcmp
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_wtol
wcsrchr
wcstoul
wcsstr
wcschr
_itow_s
qsort
_wcsnicmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_vsnprintf_s
memmove_s
memcpy_s
_wtoi
_vsnwprintf
_wcsicmp
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
memset

gpapi

ord115

rpcrt4

IUnknown_QueryInterface_Proxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient17
ObjectStublessClient16
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient12
ObjectStublessClient21
ObjectStublessClient4
ObjectStublessClient6
NdrProxyForwardingFunction15
ObjectStublessClient19
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient10
ObjectStublessClient18
ObjectStublessClient3
ObjectStublessClient22
ObjectStublessClient11
NdrProxyForwardingFunction20
ObjectStublessClient14

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoCreateGuid
StringFromGUID2
CoUninitialize
CoSetProxyBlanket
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
FindResourceExW
LoadResource
GetProcAddress
LockResource
GetModuleFileNameW
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
LoadLibraryExA
GetModuleHandleExW
LoadLibraryExW
LoadStringW
DisableThreadLibraryCalls

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalAlloc
GlobalFree
LocalReAlloc

oleaut32

VariantClear
SysAllocString
SysFreeString
SafeArrayPutElement
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
VariantTimeToDosDateTime
SysStringLen
VariantInit
SysAllocStringLen

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
SetSecurityDescriptorGroup
CopySid
AddAccessDeniedAceEx
AddAuditAccessObjectAce
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
InitializeAcl
SetSecurityDescriptorOwner
AccessCheckByType
GetSidIdentifierAuthority
GetSidSubAuthority
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetAce
AddAccessAllowedAce
GetLengthSid
GetSidSubAuthorityCount
CreateWellKnownSid
IsValidSid
AddAccessAllowedAceEx
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
MakeSelfRelativeSD
GetSecurityDescriptorControl
AllocateAndInitializeSid
FreeSid
SetSecurityDescriptorControl
IsWellKnownSid
GetSecurityDescriptorLength
DuplicateTokenEx

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegDeleteValueW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExA
RegCloseKey

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetCommandLineW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetComputerNameExW
GetTickCount64
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateThread
OpenThreadToken
OpenProcessToken
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-file-l1-1-0

RemoveDirectoryW
FindNextFileW
GetFileSizeEx
CreateDirectoryW
GetFileAttributesExW
FindClose
CreateFileW
FindFirstFileW
SetFilePointer
SetFileAttributesW
CompareFileTime
ReadFile
DeleteFileW
FileTimeToLocalFileTime
GetTempFileNameW
WriteFile

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
ReleaseMutex
InitializeCriticalSection
CreateMutexExW
CreateSemaphoreExW
CreateEventW
OpenSemaphoreW
DeleteCriticalSection
ReleaseSRWLockShared
OpenEventW
ReleaseSemaphore
SetEvent

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-path-l1-1-0

PathCchRenameExtension
PathCchCombineEx

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupAccountNameW

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrStrW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime
GetComputerNameW

ntdll

RtlSecondsSince1970ToTime
RtlFreeSid
RtlUnicodeStringToInteger
RtlAllocateAndInitializeSid
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlFreeUnicodeString
RtlInitUnicodeString
RtlConvertSidToUnicodeString

activeds

ord5
ord7
ord15
ord9
ord6
ord4

dssec

ord2

dsuiext

ord10

framedynos

?GetSYSTEMTIME@WBEMTime@@QBEHPAU_SYSTEMTIME@@@Z
??4WBEMTime@@QAEABV0@QAG@Z

gdi32

DeleteObject
SetTextColor
CreateFontIndirectW
GetTextExtentPoint32W
GetTextColor
GetDeviceCaps
ExtTextOutW
SetBkColor
GetBkColor

ole32

ReleaseStgMedium
CoInitialize

user32

EnableWindow
CheckMenuRadioItem
GetParent
GetWindowLongW
SetDlgItemTextW
GetClientRect
LoadCursorW
SetCursor
SendMessageW
GetSystemMetrics
LoadImageW
LoadIconW
GetWindowRect
MapWindowPoints
MoveWindow
TrackPopupMenu
MessageBoxW
DestroyMenu
EnableMenuItem
CheckMenuItem
GetMenuItemCount
PostMessageW
SetFocus
PtInRect
ClientToScreen
LoadMenuW
GetSubMenu
GetSysColor
LoadBitmapW
DialogBoxParamW
IsDlgButtonChecked
SendDlgItemMessageW
RegisterClipboardFormatW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
EndDialog
CheckDlgButton
WaitForInputIdle
IsWindow
ReleaseDC
GetDC
SystemParametersInfoW
DrawMenuBar
InvalidateRect
UpdateWindow
ShowWindow
RemoveMenu
GetDlgItem
MsgWaitForMultipleObjectsEx
PeekMessageW
TranslateMessage
DispatchMessageW
GetDlgItemTextW
CheckRadioButton
IsWindowEnabled
SetWindowLongW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Exports

Exports

BrowseForGPO
CreateGPOLink
DeleteAllGPOLinks
DeleteGPOLink
DllCanUnloadNow
DllGetClassObject
ExportRSoPData
ImportRSoPData

Sections

.text
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6053ad9f693649f95930ffd02707b18

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

gpapi

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l2-1-0

oleaut32

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-debug-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

ntdll

activeds

dssec

dsuiext

framedynos

gdi32

ole32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-processthreads-l1-1-1

Exports

Exports

Sections

.text Size: 496KB - Virtual size: 495KB

.data Size: 5KB - Virtual size: 8KB

.idata Size: 12KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 168B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 496KB - Virtual size: 495KB

.data
Size: 5KB - Virtual size: 8KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 168B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 23KB - Virtual size: 22KB