583f3108c569155ecbb28268b47dcb62e1b9b9891adc95939c5ffbca6840a141

Sharing

Copy URL Twitter E-mail

General

Target

583f3108c569155ecbb28268b47dcb62e1b9b9891adc95939c5ffbca6840a141
Size

189KB
MD5

5e1aed523cfe02ada28d47d1bf70a5b4
SHA1

e5de123854870ff09cc0f20cf316fc85e1cf3886
SHA256

583f3108c569155ecbb28268b47dcb62e1b9b9891adc95939c5ffbca6840a141
SHA512

95157dd6e263042d292224d2bf97d4c11854ac17901447d62945bc72325c402db2d6cd57e1512792f0fca514ac2a89600a9f6d8e2854d5aebd48228035416b5e
SSDEEP

3072:m3AfOTTkpCIGQ5HXbIt59PdN89vJV7C7KUliCQ1yt9/JfqxE:m3AGTTkgoLItHdwvJV7CBliw/JC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
583f3108c569155ecbb28268b47dcb62e1b9b9891adc95939c5ffbca6840a141

Files

583f3108c569155ecbb28268b47dcb62e1b9b9891adc95939c5ffbca6840a141
.dll windows:10 windows x64 arch:x64

3f10585a6ff54cf3ff2e08c522645520

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mskeyprotcli.pdb

Imports

msvcrt

memcpy_s
_CxxThrowException
memcmp
_purecall
_vsnwprintf
realloc
_errno
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
strrchr
memmove_s
calloc
wcsspn
wcscspn
wcsstr
_wcsicmp
wcstol
_set_errno
_XcptFilter
isdigit
_callnewh
memset
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
??1type_info@@UEAA@XZ
memcpy
malloc
free
_amsg_exit
__CxxFrameHandler3
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleFileNameA
SizeofResource
GetModuleHandleExW
FindResourceExW
LoadLibraryExW
FreeLibrary
LockResource
GetModuleHandleW
LoadResource
GetProcAddress

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW

bcrypt

BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptImportKey
BCryptExportKey
BCryptGenerateSymmetricKey
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptDestroyKey
BCryptCloseAlgorithmProvider

api-ms-win-core-heap-l1-1-0

HeapSize
HeapDestroy
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
CreateEventW
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexExW
CreateEventExW
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ReleaseSRWLockExclusive

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteTreeW
RegDeleteValueW
RegDeleteKeyExW
RegSetValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegGetValueW
RegCloseKey

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError

ntasn1

ord2
ord5
ord4

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlUnhandledExceptionFilter
NtTerminateProcess
RtlImageNtHeader
EtwGetTraceEnableFlags
LdrDisableThreadCalloutsForDll
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetProcessIdOfThread
OpenThreadToken
OpenThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
SetThreadStackGuarantee

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName
GetThreadPreferredUILanguages

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

RpcAsyncCompleteCall
RpcSsDestroyClientContext
MesBufferHandleReset
RpcAsyncCancelCall
MesDecodeBufferHandleCreate
UuidCreate
I_RpcBindingInqLocalClientPID
RpcAsyncInitializeHandle
NdrMesTypeAlignSize3
MesHandleFree
NdrMesTypeEncode3
RpcBindingFromStringBindingW
Ndr64AsyncClientCall
MesEncodeFixedBufferHandleCreate
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
IsValidSid
RevertToSelf
ImpersonateLoggedOnUser
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetTokenInformation

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

crypt32

CryptProtectData
CryptUnprotectMemory
CryptUnprotectData
CryptProtectMemory

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

userenv

GetProfileType

sspicli

LsaDeregisterLogonProcess
LogonUserExExW
LsaRegisterLogonProcess
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
LsaConnectUntrusted

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW

Exports

Exports

GetKeyProtectionInterface

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f10585a6ff54cf3ff2e08c522645520

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-synch-l1-2-0

bcrypt

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

ntasn1

ntdll

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-service-management-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-timezone-l1-1-0

crypt32

api-ms-win-core-version-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

userenv

sspicli

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-provider-l1-1-0

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 112KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 72B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 113KB - Virtual size: 112KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 72B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB