6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893

Sharing

Copy URL Twitter E-mail

General

Target

6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893
Size

896KB
MD5

cf40990167b416d25187e582eb6d34b1
SHA1

b0eadd4abb8aa70e8d5727e05df20fa3afe6e3ba
SHA256

6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893
SHA512

ff1f346aa07871d430f095ebef21f1e7a8d258dc27ec9019d6f8580eb66f309ecbda8f440a4f421cb7017592dbac7d49c0539b2aa0bfbd61b3b0bcbc0ecc24ec
SSDEEP

12288:mFsx3BDGi6P6H0zdCvdKK5UEARIgcwhxV3cG9pbOprbEmot2lYlb2fQX0+Rk7wKo:mIDHJEmot2lYU4rkMK9LGXfQqGQ07vK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893

Files

6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893
.dll windows:4 windows x86 arch:x86

6bdb5c2fad167ba2ec9fe85e92307d7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FileTimeToSystemTime
GetProcessTimes
GetExitCodeProcess
MulDiv
MultiByteToWideChar
ExpandEnvironmentStringsA
GetLogicalDrives
ExpandEnvironmentStringsW
GetDriveTypeW
GetPriorityClass
GetVolumeInformationW
TerminateProcess
WideCharToMultiByte
QueryDosDeviceW
DeviceIoControl
Sleep
MoveFileW
CopyFileW
GetDiskFreeSpaceExW
lstrcmpW
RemoveDirectoryW
MoveFileExW
DeleteFileW
GetSystemInfo
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
GetFileTime
SetFileTime
GetProcessHeap
HeapAlloc
GetFileAttributesExW
HeapFree
VirtualQuery
CreateProcessW
WriteFile
DefineDosDeviceW
SetVolumeLabelW
QueryDosDeviceA
GetDriveTypeA
VirtualQueryEx
InterlockedExchangeAdd
InterlockedCompareExchange
CreateProcessA
GetFileSize
FlushFileBuffers
CreateDirectoryW
GetFileAttributesExA
SetFileAttributesW
LocalFree
OpenProcess
GetCurrentProcess
CreateThread
GetModuleHandleA
CreateFileA
GetFileInformationByHandle
OpenMutexW
CreateMutexW
GetLastError
GetPrivateProfileStringW
GetProfileStringW
GetFileAttributesW
CreateFileW
ReadFile
GetModuleHandleW
CloseHandle
WaitForSingleObject
SetEvent
CreateEventW
ResetEvent
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FreeLibrary
LoadLibraryW
GetProcAddress
GetWindowsDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
SetPriorityClass
GetSystemDirectoryW
ReadProcessMemory
GetThreadPriority
QueryPerformanceCounter
LocalAlloc
lstrcmpA
MoveFileExA
RemoveDirectoryA
CopyFileA
CreateDirectoryA
MoveFileA
DeleteFileA
GetFileAttributesA
SetFileAttributesA
GetEnvironmentVariableW
GetTempPathW
GetTempPathA
GetCurrentDirectoryA
GetSystemDirectoryA
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenSemaphoreW
CancelIo
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
SetNamedPipeHandleState
SetEndOfFile
OpenEventW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
SetConsoleCtrlHandler
GetStringTypeW
InterlockedDecrement
lstrlenA
InterlockedIncrement
FormatMessageA
LoadResource
FindResourceExW
GetACP
lstrlenW
FormatMessageW
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SleepEx
InterlockedExchange
CreateSemaphoreW
ReleaseSemaphore
ReleaseMutex
PulseEvent
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
SuspendThread
GetExitCodeThread
FileTimeToLocalFileTime
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
ExitProcess
FatalAppExitA
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
UnhandledExceptionFilter
VirtualAlloc
SetFilePointer
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetOEMCP
LoadLibraryA
GetStringTypeA

user32

GetForegroundWindow
CloseWindowStation
SetProcessWindowStation
OpenWindowStationW
MessageBoxW
SendMessageTimeoutW
EnumDesktopWindows
IsWindowVisible
GetWindowLongW
GetParent
EnumWindows
GetClassNameW
GetDesktopWindow
GetWindowTextA
GetWindowTextW
SystemParametersInfoW
EnumDesktopsW
EnumWindowStationsW
MessageBoxA
DefWindowProcW
GetWindowThreadProcessId
FindWindowExW
GetProcessWindowStation
GetUserObjectInformationW
OpenInputDesktop
CloseDesktop
SetThreadDesktop
GetThreadDesktop
EnumChildWindows
MsgWaitForMultipleObjects
CreateWindowExW
GetClientRect
SendMessageW
AttachThreadInput
ShowWindow
SetWindowPos
SetForegroundWindow
RegisterClassW
wsprintfW
GetSystemMetrics
CloseWindow
DestroyWindow
PostMessageW
FindWindowW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
SetWindowLongW
OpenDesktopW

gdi32

GetObjectA
GetStockObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteDC
DeleteObject
GetBitmapBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA

advapi32

RegEnumValueW
RegDeleteKeyW
RegOpenKeyExW
RegDeleteValueW
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountNameW
GetFileSecurityW
AllocateAndInitializeSid
EqualSid
FreeSid
SetFileSecurityW
RegSetValueExW
RegOpenKeyW
GetUserNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegQueryValueExA
RegSetValueExA
RegEnumKeyW
RegCreateKeyA
RegCreateKeyExA
RegOpenKeyA
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegSetKeySecurity
RegQueryInfoKeyW

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SystemTimeToVariantTime
DosDateTimeToVariantTime

mpr

WNetGetConnectionW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ws2_32

WSAStartup
WSACleanup
setsockopt
accept
bind
htonl
htons
WSAIoctl
socket
connect
closesocket
shutdown
listen
ntohs
ntohl
getsockname
getsockopt
send
recv
sendto
WSAGetLastError
recvfrom
getpeername

Exports

Exports

GetAllOutgoingObjsW
GetAllSDRegionW
ISSDEncryptFileA
ISSDEncryptFileW
SDCreateOutgoingA
SDCreateOutgoingW
SDDecryptFileA
SDDecryptFileToOtherA
SDDecryptFileToOtherW
SDDecryptFileW
SDEncryptFileA
SDEncryptFileExA
SDEncryptFileExW
SDEncryptFileToOtherA
SDEncryptFileToOtherExA
SDEncryptFileToOtherExW
SDEncryptFileToOtherW
SDEncryptFileW
SDGetSecuPropertyW
SDSetSecuPropertyA
SDSetSecuPropertyW
SDStartEncryption
SDStopEncryption

Sections

.text
Size: 684KB - Virtual size: 683KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bdb5c2fad167ba2ec9fe85e92307d7a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mpr

version

ws2_32

Exports

Exports

Sections

.text Size: 684KB - Virtual size: 683KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 76KB - Virtual size: 105KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 48KB - Virtual size: 45KB

.text
Size: 684KB - Virtual size: 683KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 76KB - Virtual size: 105KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 48KB - Virtual size: 45KB