b23d3674b2e101f13e4100912ca088946eec3e72d24e84c3e840894d60963af5

Sharing

Copy URL Twitter E-mail

General

Target

b23d3674b2e101f13e4100912ca088946eec3e72d24e84c3e840894d60963af5
Size

2.6MB
MD5

27aaef7a3745acc11503559dfed3dc8a
SHA1

556de7c8424b51a42b53f1cf4d5fe0cfb7422fb4
SHA256

b23d3674b2e101f13e4100912ca088946eec3e72d24e84c3e840894d60963af5
SHA512

80c8d72e562c328e3e831c06ccbc82b3d4260e07576a868e4088f167149bfa64bbe4925735c9d2dbb8686f9251130b663406ce584f4f285cb97b6161e543c260
SSDEEP

49152:vLoH1UQqUKfL0b3wzPYyE+BODR3I/URl5o51DfaNHFrqb5+xpFOy4ZzU69K82FFW:vUKfL0b3wzPYyE+BODR3I/cl5ovTalFa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b23d3674b2e101f13e4100912ca088946eec3e72d24e84c3e840894d60963af5

Files

b23d3674b2e101f13e4100912ca088946eec3e72d24e84c3e840894d60963af5
.dll windows:4 windows x64 arch:x64

cf334de683bc76814fd604b626c61634

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

GetUserNameA

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateSemaphoreA
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileAttributesA
GetFileAttributesExA
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount64
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalFree
MoveFileExA
MultiByteToWideChar
OpenProcess
OutputDebugStringA
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEnvironmentVariableA
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SleepEx
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_beginthreadex
_chmod
_close
_endthreadex
_errno
_findclose
_findfirst64
_findnext64
_fullpath
_initterm
_lock
_pclose
_popen
_putenv
_read
_setjmp
_stat64
_time64
_ultoa
_unlock
_write
abort
atoi
calloc
exit
fclose
feof
fflush
fgetc
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
isalnum
isalpha
islower
isspace
isupper
isxdigit
localeconv
malloc
mbtowc
memchr
memcpy
memmove
memset
printf
putc
realloc
signal
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcslen
wctomb
longjmp
_unlink
_strdup
_rmdir
_open
_isatty
_fileno

secur32

AcquireCredentialsHandleA
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA

shell32

SHGetFolderPathA

ws2_32

WSAIoctl
WSASocketA

wsock32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
bind
closesocket
connect
gethostbyname
getsockname
getsockopt
htonl
htons
ioctlsocket
ntohl
ntohs
recv
select
send
setsockopt
socket

libcrypto-1_1-x64

ASN1_TIME_diff
BIO_ctrl
BIO_f_base64
BIO_free_all
BIO_new
BIO_new_mem_buf
BIO_push
BIO_read
BIO_s_mem
BIO_set_flags
BIO_write
CRYPTO_free
CRYPTO_malloc
CRYPTO_zalloc
ERR_clear_error
ERR_get_error
ERR_reason_error_string
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_set_padding
EVP_CipherInit_ex
EVP_DecryptFinal
EVP_DecryptUpdate
EVP_Digest
EVP_EncryptFinal
EVP_EncryptUpdate
EVP_PKEY_size
EVP_aes_128_cbc
EVP_enc_null
EVP_md_null
EVP_sha1
EVP_sha256
EVP_sm3
HMAC
PKCS5_PBKDF2_HMAC
RAND_priv_bytes
X509_NAME_get_text_by_NID
X509_STORE_CTX_get_error
X509_STORE_CTX_set_error
X509_STORE_load_locations
X509_STORE_set_flags
X509_free
X509_get0_notAfter
X509_get0_pubkey
X509_get_signature_nid
X509_get_subject_name

libssl-1_1-x64

GMTLS_client_method
OPENSSL_init_ssl
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get0_certificate
SSL_CTX_get_cert_store
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_set_cipher_list
SSL_CTX_use_certificate_chain_file
SSL_check_private_key
SSL_connect
SSL_free
SSL_get_error
SSL_get_peer_certificate
SSL_new
SSL_pending
SSL_read
SSL_set_default_passwd_cb_userdata
SSL_set_ex_data
SSL_set_fd
SSL_set_security_callback
SSL_set_verify
SSL_set_verify_depth
SSL_shutdown
SSL_use_PrivateKey_file
SSL_use_certificate_file
SSL_write
TLSv1_2_method

Exports

Exports

PQLocalSockaddr
PQRemoteSockaddr
PQbackendPID
PQbinaryTuples
PQcancel
PQclear
PQclientEncoding
PQcmdStatus
PQcmdTuples
PQconndefaults
PQconnectPoll
PQconnectStart
PQconnectStartParams
PQconnectdb
PQconnectdbParams
PQconnectionNeedsPassword
PQconnectionUsedPassword
PQconninfoFree
PQconninfoParse
PQconsumeInput
PQcopyResult
PQdb
PQdescribePortal
PQdescribePrepared
PQdisplayTuples
PQdsplen
PQencryptPassword
PQendcopy
PQenv2encoding
PQerrorMessage
PQescapeBytea
PQescapeByteaConn
PQescapeIdentifier
PQescapeLiteral
PQescapeString
PQescapeStringConn
PQexec
PQexecParams
PQexecParamsBatch
PQexecPrepared
PQexecPreparedBatch
PQfformat
PQfinish
PQfireResultCreateEvents
PQflush
PQfmod
PQfn
PQfname
PQfnumber
PQfreeCancel
PQfreeNotify
PQfreemem
PQfsize
PQftable
PQftablecol
PQftype
PQgetCancel
PQgetCopyData
PQgetResult
PQgetisnull
PQgetlength
PQgetline
PQgetlineAsync
PQgetssl
PQgetvalue
PQhost
PQinitOpenSSL
PQinitSSL
PQinstanceData
PQisBusy
PQisnonblocking
PQisthreadsafe
PQlibVersion
PQmakeEmptyPGresult
PQmblen
PQnfields
PQnotifies
PQnparams
PQntuples
PQoidStatus
PQoidValue
PQoptions
PQparameterStatus
PQparamtype
PQpass
PQping
PQpingParams
PQport
PQprepare
PQprint
PQprintTuples
PQprotocolVersion
PQputCopyData
PQputCopyEnd
PQputline
PQputnbytes
PQregisterEventProc
PQregisterThreadLock
PQrequestCancel
PQresStatus
PQreset
PQresetPoll
PQresetStart
PQresultAlloc
PQresultErrorField
PQresultErrorMessage
PQresultInstanceData
PQresultSetInstanceData
PQresultStatus
PQsendDescribePortal
PQsendDescribePrepared
PQsendPrepare
PQsendQuery
PQsendQueryParams
PQsendQueryParamsBatch
PQsendQueryPrepared
PQsendQueryPreparedBatch
PQserverVersion
PQsetClientEncoding
PQsetErrorVerbosity
PQsetInstanceData
PQsetNoticeProcessor
PQsetNoticeReceiver
PQsetResultAttrs
PQsetRwTimeout
PQsetSingleRowMode
PQsetdbLogin
PQsetnonblocking
PQsetvalue
PQsocket
PQstatus
PQtrace
PQtransactionStatus
PQtty
PQunescapeBytea
PQuntrace
PQuser
appendBinaryPQExpBuffer
appendPQExpBuffer
appendPQExpBufferChar
appendPQExpBufferStr
createPQExpBuffer
destroyPQExpBuffer
enlargePQExpBuffer
initPQExpBuffer
lo_close
lo_creat
lo_create
lo_export
lo_import
lo_import_with_oid
lo_lseek
lo_open
lo_read
lo_tell
lo_truncate
lo_unlink
lo_write
pg_char_to_encoding
pg_encoding_to_char
pgresStatus
printfPQExpBuffer
resetPQExpBuffer
termPQExpBuffer

Sections

.text
Size: 334KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf334de683bc76814fd604b626c61634

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

secur32

shell32

ws2_32

wsock32

libcrypto-1_1-x64

libssl-1_1-x64

Exports

Exports

Sections

.text Size: 334KB - Virtual size: 333KB

.data Size: 7KB - Virtual size: 7KB

.rdata Size: 53KB - Virtual size: 52KB

/4 Size: 40KB - Virtual size: 39KB

.pdata Size: 12KB - Virtual size: 11KB

.xdata Size: 11KB - Virtual size: 11KB

.bss Size: - Virtual size: 4KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 2KB - Virtual size: 1KB

/14 Size: 5KB - Virtual size: 5KB

/29 Size: 1.7MB - Virtual size: 1.7MB

/41 Size: 69KB - Virtual size: 69KB

/55 Size: 130KB - Virtual size: 129KB

/67 Size: 512B - Virtual size: 72B

/80 Size: 14KB - Virtual size: 13KB

/91 Size: 138KB - Virtual size: 137KB

/102 Size: 10KB - Virtual size: 9KB

.text
Size: 334KB - Virtual size: 333KB

.data
Size: 7KB - Virtual size: 7KB

.rdata
Size: 53KB - Virtual size: 52KB

/4
Size: 40KB - Virtual size: 39KB

.pdata
Size: 12KB - Virtual size: 11KB

.xdata
Size: 11KB - Virtual size: 11KB

.bss
Size: - Virtual size: 4KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 2KB - Virtual size: 1KB

/14
Size: 5KB - Virtual size: 5KB

/29
Size: 1.7MB - Virtual size: 1.7MB

/41
Size: 69KB - Virtual size: 69KB

/55
Size: 130KB - Virtual size: 129KB

/67
Size: 512B - Virtual size: 72B

/80
Size: 14KB - Virtual size: 13KB

/91
Size: 138KB - Virtual size: 137KB

/102
Size: 10KB - Virtual size: 9KB