97d21eecefc9e7f5f09391d12a0f0d62d156c12548de12ce9d570fc159623061

Sharing

Copy URL Twitter E-mail

General

Target

97d21eecefc9e7f5f09391d12a0f0d62d156c12548de12ce9d570fc159623061
Size

776KB
MD5

5b659305f98f2532e2cdc61ef84f648e
SHA1

b96d5cdf66be32e5f6c81ec8049318c379efa9d5
SHA256

97d21eecefc9e7f5f09391d12a0f0d62d156c12548de12ce9d570fc159623061
SHA512

304ffe15a6a957ae2fd5756215cb93d84a8939c8424b95b3072d46a5e89b094c8408b22a67b2e4ccc6402034e0a2a9671e81ac743bfc8b30a8bcb2a4e5a047ac
SSDEEP

24576:Ip6JYWyPvYEp2Xb5I5i0GUKXkLS4LmJrc8eC:IE9ynY02Xu5WkLScmi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97d21eecefc9e7f5f09391d12a0f0d62d156c12548de12ce9d570fc159623061

Files

97d21eecefc9e7f5f09391d12a0f0d62d156c12548de12ce9d570fc159623061
.dll windows:5 windows x86 arch:x86

6d3ded2dd3c14ce299ed9a268b151dab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo

cryptopp

??0Algorithm@CryptoPP@@QAE@_N@Z
?SetKey@SimpleKeyingInterface@CryptoPP@@UAEXPBEIABVNameValuePairs@2@@Z
?UncheckedSetKey@Base@Rijndael@CryptoPP@@UAEXPBEIABVNameValuePairs@3@@Z
?ProcessAndXorBlock@Enc@Rijndael@CryptoPP@@UBEXPBE0PAE@Z
?AdvancedProcessBlocks@Enc@Rijndael@CryptoPP@@UBEIPBE0PAEII@Z
?GetNextIV@SimpleKeyingInterface@CryptoPP@@UAEXAAVRandomNumberGenerator@2@PAE@Z
?OptimalDataAlignment@BlockTransformation@CryptoPP@@UBEIXZ
?UnalignedAllocate@CryptoPP@@YAPAXI@Z
?ProcessAndXorBlock@Dec@Rijndael@CryptoPP@@UBEXPBE0PAE@Z
?AdvancedProcessBlocks@Dec@Rijndael@CryptoPP@@UBEIPBE0PAEII@Z
?UnalignedDeallocate@CryptoPP@@YAXPAX@Z

qt5core

?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
??0QByteArray@@QAE@XZ
??0QByteArray@@QAE@HD@Z
??0QByteArray@@QAE@ABV0@@Z
?data@QByteArray@@QBEPBDXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?append@QByteArray@@QAEAAV1@PBDH@Z
?append@QByteArray@@QAEAAV1@ABV1@@Z
?append@QString@@QAEAAV1@ABVQByteArray@@@Z
?toString@QUuid@@QBE?AVQString@@XZ
?createUuid@QUuid@@SA?AV1@XZ
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?qt_metacast@QObject@@UAEPAXPBD@Z
?qt_metacall@QObject@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?staticMetaObject@QObject@@2UQMetaObject@@B
?msleep@QThread@@SAXK@Z
??6QDebug@@QAEAAV0@ABVQByteArray@@@Z
??6QDebug@@QAEAAV0@PBD@Z
??1QDebug@@QAE@XZ
??1QObject@@UAE@XZ
??0QObject@@QAE@PAV0@@Z
?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z
?toLocal8Bit@QString@@QGBE?AVQByteArray@@XZ
?clear@QString@@QAEXXZ
??4QString@@QAEAAV0@ABV0@@Z
??1QString@@QAE@XZ
??0QString@@QAE@XZ
?data@QByteArray@@QAEPADXZ
??4QByteArray@@QAEAAV0@$$QAV0@@Z
?debug@QMessageLogger@@QBE?AVQDebug@@XZ
??0QMessageLogger@@QAE@PBDH0@Z
?toHex@QByteArray@@QBE?AV1@XZ
?toUpper@QByteArray@@QHAE?AV1@XZ
?constData@QByteArray@@QBEPBDXZ
??1QByteArray@@QAE@XZ
??0QByteArray@@QAE@PBDH@Z

msvcp140

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
CancelIo
CreateFileA
LoadLibraryA
CreateEventW
FormatMessageW
CloseHandle
ReadFile
WriteFile
WaitForSingleObject
ResetEvent
GetOverlappedResult
GetLastError
LocalFree
GetProcAddress
FreeLibrary

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
strstr
__std_exception_destroy
__std_exception_copy
__std_terminate
__CxxFrameHandler3
memcpy
memset
_purecall
memmove
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_invalid_parameter_noinfo
_errno
_register_onexit_function
_initialize_onexit_table
_initterm_e
_initterm
_crt_atexit
_seh_filter_dll
_cexit
_initialize_narrow_environment

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

_wcsdup
strncpy

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-convert-l1-1-0

strtol

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

Exports

Exports

GetDevID

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.:9\
Size: 592KB - Virtual size: 592KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d3ded2dd3c14ce299ed9a268b151dab

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

cryptopp

qt5core

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

advapi32

Exports

Exports

Sections

.text Size: 133KB - Virtual size: 133KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 2KB - Virtual size: 12KB

.gfids Size: 512B - Virtual size: 56B

.:9\ Size: 592KB - Virtual size: 592KB

.reloc Size: 6KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: 133KB - Virtual size: 133KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 2KB - Virtual size: 12KB

.gfids
Size: 512B - Virtual size: 56B

.:9\
Size: 592KB - Virtual size: 592KB

.reloc
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 469B