58ce360ef9b439cb31771480d5f020070a4cae5ec95be2081f52892e38eeb00f

Sharing

Copy URL Twitter E-mail

General

Target

58ce360ef9b439cb31771480d5f020070a4cae5ec95be2081f52892e38eeb00f
Size

356KB
MD5

1c732617a016ab43d2b94f4d343cf0b9
SHA1

c2446da17e35d73c55730846db75928817b4bb36
SHA256

58ce360ef9b439cb31771480d5f020070a4cae5ec95be2081f52892e38eeb00f
SHA512

cde211749b1b0696672d1ca07cbd9ac3f84f8122a08cb5ccdee22493e993e0f164b16f60cab1763feff74b49a189cd1675ec81390c6f1052dcd7128399055a10
SSDEEP

6144:TjoJu+3ak4uOzG49iKq9nh1pDuGVGqlNyfEeRg3ZR8LpQYdWkhKXxR8pmtU:TUUuakdOz39iKq9h1pDuGAqlNyfEeRgP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
58ce360ef9b439cb31771480d5f020070a4cae5ec95be2081f52892e38eeb00f

Files

58ce360ef9b439cb31771480d5f020070a4cae5ec95be2081f52892e38eeb00f
.dll windows:10 windows x64 arch:x64

39e8f6ee62673b393a5bcc72d73ec23c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dlnashext.pdb

Imports

msvcrt

_callnewh
_ui64tow_s
__dllonexit
_unlock
wcschr
??0exception@@QEAA@AEBQEBD@Z
realloc
wcscspn
wcsstr
memcpy_s
_vsnwprintf
??0exception@@QEAA@AEBQEBDH@Z
towupper
??1exception@@UEAA@XZ
wcspbrk
_lock
_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
memset
iswalpha
_CxxThrowException
__C_specific_handler
iswdigit
memcpy
_initterm
malloc
_amsg_exit
memmove
_XcptFilter
wcsrchr
_errno
memmove_s
free
_purecall
_wtoi
_set_errno
_get_errno
calloc
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler4
??3@YAXPEAX@Z
_snwscanf_s
wcscmp

api-ms-win-core-synch-l1-2-0

InitOnceComplete
SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep
WakeAllConditionVariable
InitOnceBeginInitialize

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags

api-ms-win-core-com-l1-1-0

PropVariantClear
CoTaskMemAlloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoGetMalloc
CoGetApartmentType
CoInitializeEx
CLSIDFromString
CoTaskMemFree
CoUninitialize

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
DeleteCriticalSection
CreateEventExW
ReleaseMutex
CreateSemaphoreExW
EnterCriticalSection
OpenSemaphoreW
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateEventW
AcquireSRWLockExclusive
SetEvent
WaitForSingleObjectEx
InitializeCriticalSection
ReleaseSemaphore
CreateMutexExW
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LoadResource
FindStringOrdinal
LoadStringW
SizeofResource
GetModuleHandleW
DisableThreadLibraryCalls
LockResource
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
SetThreadPriority
ResumeThread
GetCurrentProcessId
TerminateProcess
TlsAlloc
GetThreadPriority
TlsSetValue
TlsGetValue
GetCurrentProcess
TlsFree
CreateThread
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-shell-associations-l1-1-0

AssocGetDetailsOfPropKey
AssocCreateForClasses

api-ms-win-shell-changenotify-l1-1-0

SHChangeNotify

api-ms-win-shell-dataobject-l1-1-0

SHCreateDataObject

api-ms-win-shell-namespace-l1-1-0

ILClone
ILFree
SHBindToFolderIDListParent
SHGetNameFromIDList
ILGetSize
ILCloneFirst
SHCreateItemFromIDList
ILCombine
SHParseDisplayName
SHGetIDListFromObject
ILIsEqual

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

api-ms-win-core-path-l1-1-0

PathCchFindExtension
PathCchRemoveExtension
PathCchCombine

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW
MultiByteToWideChar

api-ms-win-core-url-l1-1-0

UrlIsW

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalAlloc
LocalFree

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrStrIW
QISearch

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapDestroy
HeapFree
HeapSize

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CallbackMayRunLong
CloseThreadpoolTimer
FreeLibraryWhenCallbackReturns

api-ms-win-core-kernel32-legacy-l1-1-0

FileTimeToDosDateTime
GetComputerNameW

api-ms-win-core-string-l2-1-0

CharLowerBuffW
CharUpperBuffW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-featurestaging-l1-1-0

RecordFeatureUsage
UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification

api-ms-win-core-localization-l1-2-0

FormatMessageW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 236KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39e8f6ee62673b393a5bcc72d73ec23c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-shell-associations-l1-1-0

api-ms-win-shell-changenotify-l1-1-0

api-ms-win-shell-dataobject-l1-1-0

api-ms-win-shell-namespace-l1-1-0

oleaut32

api-ms-win-core-path-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-localization-l1-2-0

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 234KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 8KB - Virtual size: 7KB

.pdata Size: 16KB - Virtual size: 13KB

.didat Size: 4KB - Virtual size: 584B

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 236KB - Virtual size: 234KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 8KB - Virtual size: 7KB

.pdata
Size: 16KB - Virtual size: 13KB

.didat
Size: 4KB - Virtual size: 584B

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB