54207e5c703cccc0ec395273f15e1105236aeedbd2830c2ed9c2e18d84183a10

Sharing

Copy URL Twitter E-mail

General

Target

54207e5c703cccc0ec395273f15e1105236aeedbd2830c2ed9c2e18d84183a10
Size

312KB
MD5

f2796dbc93368965f51acfb063576c67
SHA1

ba2d2745cc6a22c26c2255d0df72cf424dce2a44
SHA256

54207e5c703cccc0ec395273f15e1105236aeedbd2830c2ed9c2e18d84183a10
SHA512

d42d4ad3149d8c2be0be1b4bb27c25d6523c6936235cc3402336933b16a9a0f9c950b2171e230854198328e42242ef973788068a9506534be9209e65b6cbd9d0
SSDEEP

6144:Lv600IxKjhh8eAaV/QTDykHG5BkH8WoMuhHa4zM8Ren+FZreX5:LiYx8OTDycG5BkH8WYh8Ee

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54207e5c703cccc0ec395273f15e1105236aeedbd2830c2ed9c2e18d84183a10

Files

54207e5c703cccc0ec395273f15e1105236aeedbd2830c2ed9c2e18d84183a10
.dll windows:10 windows x64 arch:x64

133aae315500eaf3bc0870df4e01ca1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WLIDCredProv.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
memmove_s
wcscmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o_calloc
_o_free
_o_malloc
_o_memcpy_s
_o_toupper
_o_wcscpy_s
_o_wcstol
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
wcschr
wcsstr
_o__crt_atexit
strrchr
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadResource
GetModuleFileNameA
LockResource
SizeofResource
FindResourceExW
LoadLibraryExW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
CreateSemaphoreExW
InitializeCriticalSectionEx
CreateEventExW
ReleaseSemaphore
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
ResetEvent
SetEvent

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
HeapDestroy
HeapFree
HeapSize
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetProcessIdOfThread
OpenThreadToken
GetCurrentThread
OpenProcessToken
OpenThread

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName
GetThreadPreferredUILanguages
GetThreadUILanguage

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetSystemDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoGetMalloc
StringFromGUID2
CoTaskMemFree
CoGetCallerTID

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegSetValueExW
RegEnumValueW
RegGetValueW
RegSetKeySecurity
RegOpenKeyExW
RegEnumKeyExW
RegOpenCurrentUser
RegDeleteKeyExW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorSacl
IsValidSid
CreateWellKnownSid
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser
GetSecurityDescriptorDacl

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch
StrRChrW

ntdll

RtlNtStatusToDosError
RtlInitString
RtlGetDeviceFamilyInfoEnum
NtQueryWnfStateData

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

133aae315500eaf3bc0870df4e01ca1b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 161KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 92KB - Virtual size: 91KB

.data Size: 4KB - Virtual size: 14KB

.pdata Size: 12KB - Virtual size: 10KB

.didat Size: 4KB - Virtual size: 608B

.rsrc Size: 24KB - Virtual size: 21KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 164KB - Virtual size: 161KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 4KB - Virtual size: 14KB

.pdata
Size: 12KB - Virtual size: 10KB

.didat
Size: 4KB - Virtual size: 608B

.rsrc
Size: 24KB - Virtual size: 21KB

.reloc
Size: 4KB - Virtual size: 2KB