9813292797bc762efc488ceb0a38cc65fe4ea1eafc5a031cbd0aea47985d940e

Sharing

Copy URL Twitter E-mail

General

Target

9813292797bc762efc488ceb0a38cc65fe4ea1eafc5a031cbd0aea47985d940e
Size

1.7MB
MD5

6fee1684f2a2ac08863b1955fc2bb5e6
SHA1

4b9b12769238b18d861d1136a0fcd90c026b2374
SHA256

9813292797bc762efc488ceb0a38cc65fe4ea1eafc5a031cbd0aea47985d940e
SHA512

7fecbceba60c9e5166d24011b4e8745a02193ff035310cf8480f748d0930c404b61bc74af97341241ad4b96dec927951a8c99f858cf93bc18bf2ea0f2cf9f5cc
SSDEEP

12288:bRPjVrPg5EaMmC36QjlIrRRmUEdYR6QjlIMYJ2qsrTYPsJRRL:9PprvarC36QjGryKR6QjGLq+Mv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9813292797bc762efc488ceb0a38cc65fe4ea1eafc5a031cbd0aea47985d940e

Files

9813292797bc762efc488ceb0a38cc65fe4ea1eafc5a031cbd0aea47985d940e
.dll windows:6 windows x86 arch:x86

fbfac9a8660307f0f53716c86d4d04d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TabletPC.pdb

Imports

msvcrt

?terminate@@YAXXZ
_ftol2
_ui64tow_s
wcsncpy_s
_ftol2_sse
__CxxFrameHandler3
_vsnwprintf
memset
free
wcstoul
wcschr
_wcsdup
??2@YAPAXI@Z
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memcpy_s
_wcsicmp
_purecall
memcpy
_onexit
_lock
_beginthreadex
malloc
wcscpy_s
calloc
??3@YAXPAX@Z
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter

kernel32

InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GlobalAddAtomW
DeleteAtom
GetVersionExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WaitForSingleObject
GetUserDefaultUILanguage
LocalFree
SearchPathW
lstrcmpW
Sleep
FreeLibrary
CompareStringW
ExpandEnvironmentStringsW
CreateProcessW
CloseHandle
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
GetVersion
VirtualAlloc
VirtualFree
CreateFileW
GetLocaleInfoW
MulDiv
FlushInstructionCache
WaitForMultipleObjects
InterlockedIncrement
CreateEventW
LoadLibraryExW
LoadLibraryA
GetModuleHandleA
InterlockedExchange
GetVersionExA
LoadLibraryW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
RaiseException
HeapSize
GetModuleHandleW
DisableThreadLibraryCalls
GetFileAttributesW
GetProcAddress
lstrlenW

shell32

ShellExecuteExW

user32

SetWindowTextW
LoadBitmapW
KillTimer
EnableWindow
ShowWindow
SendMessageW
SendDlgItemMessageW
LoadStringW
GetMonitorInfoW
OffsetRect
InSendMessage
SetWindowPos
MonitorFromRect
GetWindowRect
EnumDisplaySettingsExW
CheckDlgButton
CopyRect
ScreenToClient
IsCharAlphaNumericW
CreateWindowExW
GetSysColor
PtInRect
InvalidateRect
DestroyWindow
GetDlgItem
FillRect
GetSysColorBrush
UnregisterClassA
EnumChildWindows
RemovePropW
SetPropW
TrackMouseEvent
IsWindow
GetFocus
SetWindowsHookExW
UnhookWindowsHookEx
CallWindowProcW
PostMessageW
CallNextHookEx
GetKeyState
MapVirtualKeyW
GetKeyNameTextW
CheckRadioButton
IsDlgButtonChecked
GetKeyboardLayout
SetRect
CopyImage
DrawTextExW
UnionRect
SetRectEmpty
DrawTextW
SetCursor
LoadCursorW
MapWindowPoints
RegisterClassExW
LoadImageW
SendMessageTimeoutW
MoveWindow
FindWindowExW
GetKeyboardLayoutList
DeferWindowPos
BeginPaint
EndPaint
GetDialogBaseUnits
GetClassInfoExW
DefWindowProcW
DrawEdge
DrawStateW
EndDeferWindowPos
BeginDeferWindowPos
DestroyIcon
SetParent
EndDialog
GetWindowTextLengthW
GetWindowTextW
DialogBoxParamW
GetDlgItemTextW
SetFocus
SetDlgItemTextW
GetClientRect
GetParent
SetWindowLongW
GetWindowLongW
SystemParametersInfoW
RegisterWindowMessageW
SetProcessDPIAware
FindWindowW
SetForegroundWindow
MessageBoxW
GetDC
GetSystemMetrics
ReleaseDC

gdi32

CreateRoundRectRgn
SelectObject
CreateFontIndirectW
GetObjectW
DeleteObject
GetDeviceCaps
SetDIBits
GetDIBits
SetTextColor
SetBkMode
GdiAlphaBlend
DeleteDC
CreateCompatibleDC
SetBkColor
CreatePen
CreateSolidBrush
GetTextMetricsW
GetStockObject
CreateDIBSection
GetTextExtentPoint32W
GetTextExtentPointW
FillRgn

advapi32

RegisterTraceGuidsW
RegNotifyChangeKeyValue
EqualSid
LookupAccountNameW
ConvertSidToStringSidW
RegGetValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegOpenKeyW
RegCloseKey
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage

shlwapi

PathUnExpandEnvStringsW
PathQuoteSpacesW
StrStrIW
SHAutoComplete
PathIsURLW
PathGetArgsW
StrDupW
PathRemoveArgsW
PathRemoveBlanksW
PathUnquoteSpacesW
wnsprintfW
StrToIntW
StrChrW
StrToIntExW

ole32

CoCreateGuid
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysAllocString
SysFreeString

imm32

ImmAssociateContext
ImmGetContext
ImmReleaseContext

uxtheme

DrawThemeBackground
GetThemeFont
IsThemeActive
OpenThemeData
GetThemeColor
CloseThemeData

ntdll

EtwLogTraceEvent
EtwTraceMessage
WinSqmIsOptedIn
WinSqmIncrementDWORD

tabbtn

?FreeData@CButtonAction@@QAEXXZ
?GetAllowedActions@CButtonSetting@@QAEPBGXZ
?SetId@CButtonAction@@QAEXK@Z
?SetDataDWORD@CButtonAction@@QAEJK@Z
?GetActionAt@CActions@@QAEPAUACTION@@H@Z
?GetCount@CActions@@QAEHXZ
?GetDisallowedActions@CButtonSetting@@QAEPBGXZ
?SetData@CButtonAction@@QAEJQAEK@Z
?Clone@CButtonAction@@QBEJPAPAV1@@Z
?Set@CButtonAction@@QAEJPBV1@@Z
?MakeAllUserActionsEqual@CButtonSetting@@QAEJK@Z
??0CButtonConfig@@QAE@XZ
??0CActions@@QAE@XZ
?Init@CActions@@QAEJXZ
?Init@CButtonConfig@@QAEJH@Z
?GetCurrentDisplayOrientation@CButtonConfig@@QAEKXZ
?GetDescription@COrientation@@QAEPBGXZ
?GetFlags@CButtonSetting@@QAEKXZ
?GetButtonName@CButtonSetting@@QAEPBGXZ
?FindActionById@CActions@@QAEPAUACTION@@K@Z
?CanRepeat@CButtonAction@@QBEHXZ
?GetId@CButtonAction@@QBEKXZ
?GetDataDWORD@CButtonAction@@QBE?BKXZ
?GetData@CButtonAction@@QBEQAEXZ
?GetSize@CButtonAction@@QBEKXZ
?GetDetailImage@CButtonSettings@@QAEPAUHBITMAP__@@KK@Z
?GetLocationImage@CButtonSettings@@QAEPAUHBITMAP__@@KK@Z
??1CActions@@QAE@XZ
??1CButtonConfig@@QAE@XZ
?SaveSettings@CButtonConfig@@QAEJXZ
??1CButtonAction@@QAE@XZ
?IsSameAction@CButtonAction@@QBEHPBV1@@Z
??A?$CSimpleArray@PAVCOrientation@@V?$CSimpleArrayEqualHelper@PAVCOrientation@@@ATL@@@ATL@@QAEAAPAVCOrientation@@H@Z
?GetButtonFromId@CButtonSettings@@QAEJKPAPAVCButtonSetting@@@Z
?GetButtonIdFromIndex@CButtonSettings@@QAEKK@Z
?GetMode@COrientation@@QAEKXZ
?GetActionFromOrientation@CButtonSetting@@QAEJKPAPAVCButtonAction@@00@Z
?GetButtonCount@CButtonSettings@@QBEHXZ

slc

SLGetWindowsInformationDWORD

secur32

LsaFreeReturnBuffer
LsaEnumerateLogonSessions
GetUserNameExW
LsaGetLogonSessionData

hid

HidP_GetUsageValue
HidP_GetSpecificValueCaps
HidD_FreePreparsedData
HidD_GetProductString
HidD_GetAttributes
HidP_GetCaps
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetFeature

setupapi

SetupDiGetClassDevsExW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW

windowscodecs

WICCreateImagingFactory_Proxy

Exports

Exports

CPlApplet
DllMain

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbfac9a8660307f0f53716c86d4d04d9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

shell32

user32

gdi32

advapi32

shlwapi

ole32

oleaut32

imm32

uxtheme

ntdll

tabbtn

slc

secur32

hid

setupapi

windowscodecs

Exports

Exports

Sections

.text Size: 167KB - Virtual size: 167KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 167KB - Virtual size: 167KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 8KB - Virtual size: 8KB