b03251ce7c03acfa8085ebe725e04d37459c23f36924c7ee8259f6e625e28803

Sharing

Copy URL Twitter E-mail

General

Target

b03251ce7c03acfa8085ebe725e04d37459c23f36924c7ee8259f6e625e28803
Size

401KB
MD5

92e9d3bacd01bf6ee440b84b390f2e91
SHA1

c9d67bb77a7261fb95223f0c0d832311581cd586
SHA256

b03251ce7c03acfa8085ebe725e04d37459c23f36924c7ee8259f6e625e28803
SHA512

d7377420b4ff53a95f6985aab7f9e43cc4665efcbdfc14e096aa9bd93aa34446e56ad487330c8b7be3bd56b5aecce12b4947488bf7bc310a09d96eb0c7e3604a
SSDEEP

12288:qgRf5R++CLNIyJzAQaDYS/25s9i+ek4MU/r:qgx++ijzM26O9R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b03251ce7c03acfa8085ebe725e04d37459c23f36924c7ee8259f6e625e28803

Files

b03251ce7c03acfa8085ebe725e04d37459c23f36924c7ee8259f6e625e28803
.dll windows:4 windows x86 arch:x86

f401451055d0571f82015e953538381e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord114
ord120
ord46
ord26
ord48
ord34
ord145
ord118
ord103
ord67
ord124
ord73
ord171
ord74
ord163
ord160
ord159
ord121
ord125
ord17
ord8
ord70
ord147
ord47
ord144
ord31
ord158
ord20
ord117
ord58
ord204
ord112
ord189
ord116
ord139
ord170
ord32
ord49

kernel32

DeleteFileW
InterlockedExchange
SetEndOfFile
TerminateProcess
OpenProcess
lstrcmpiA
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
lstrcmpW
OpenMutexA
Sleep
GetDiskFreeSpaceW
lstrcatW
FindClose
lstrcmpiW
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
RemoveDirectoryA
lstrcatA
lstrcpyA
lstrcpynA
GetLocaleInfoA
GetLastError
UnlockFile
WriteFile
LockFile
SetFilePointer
ReadFile
GetExitCodeProcess
CloseHandle
WaitForSingleObject
DeleteFileA
RaiseException
CreateProcessA
LocalAlloc
LocalFree
WideCharToMultiByte
lstrlenA
GetVersionExA
LoadLibraryA
GetProcAddress
lstrcmpA
GetTempPathW
GetTempFileNameW
CreateFileW
GetTempPathA
GetTempFileNameA
CreateFileA
DuplicateHandle
GetCurrentProcess
GetStdHandle
CreateProcessW

user32

GetWindowThreadProcessId
PostMessageA
IsWindow
GetWindowTextW
EnumWindows
GetWindowLongA
wsprintfW
wsprintfA
GetForegroundWindow
MessageBoxW
EnumChildWindows
SendMessageA
GetClassNameA

comdlg32

GetOpenFileNameA

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Exports

Exports

AI_AuthorSinglePackage
AI_ResolveKnownFolders
AI_SearchOfficeAddins
ActiveInternetConnection
AddCaspolSecurityPolicy
BrowseForFile
CheckFreeTCPPort
CheckIfUserExists
ChooseTextStyles
CloseApplication
CollectFeaturesWithoutCab
ComputeReplaceProductsList
CreateExeProcess
DeleteEmptyDirectory
DeleteFromComboBox
DeleteFromListBox
DeleteShortcuts
DetectProcess
DetectService
DisableFeatures
EnumStartedServices
ExtractComboBoxData
ExtractListBoxData
GetArpIconPath
GetFreeTCPPort
GetLocalizedCredentials
GetPathFreeSpace
GetVideoMemory
IsRunningOnVM
JoinFiles
LaunchApp
LaunchLogFile
LoadShortcutDirs
LogOnAsAService
MixedAllUsersInstallLocation
MsgBox
MsmTrialMessage
PlayAudioFile
PopulateComboBox
PopulateListBox
PrepareUpgrade
PreserveInstallType
PreventInstancesUpgrade
PrintRTF
RemoveCaspolSecurityPolicy
RequiredJdkExists
RequiredJreExists
ResolveKnownFolder
ResolveServiceProperties
RestoreLocation
RunAllExitActions
RunAsAdmin
RunFinishActions
SetLatestVersionPath
StopProcess
TrialMessage
UninstallPreviousVersions
UpdateFeatureStates
UpdateInstallMode
UpdateMsiEditControls
ViewReadMe
WarningMessageBox

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 893B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f401451055d0571f82015e953538381e

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

user32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 1024B - Virtual size: 893B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 1024B - Virtual size: 893B

.reloc
Size: 3KB - Virtual size: 2KB