368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d

Sharing

Copy URL

Twitter E-mail

General

Target

368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d
Size

1.0MB
MD5

68dd3315e6025551422cc8d151b30f35
SHA1

21a2896d50fb22d75322353c470c6d53218ccfa3
SHA256

368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d
SHA512

c0d29661dc1c798476ddc952a2c80010dfada3f8614a9232a8bdc396aee721f06119199d8d63ebfe0172de048eeba13d1c117cc3aa25715f33cfc05cde82bc21
SSDEEP

12288:VmO5sFyb8WMYX5nSnx1tMti/rgDWa7TjO5Z203pDD0NpTbT04T:EO5sWpSnxljgSa7Tjp03pX0PTbA4T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d

Files

368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d
.dll windows:4 windows x86 arch:x86

7a8268af9be8d31e489636d3f3824b44

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedIncrement
GetFileSize
CreateFileW
WaitNamedPipeW
OpenFileMappingW
SetLastError
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
GlobalAlloc
GetProfileStringA
GetVersion
FreeLibrary
GetUserDefaultLangID
DefineDosDeviceA
GetDiskFreeSpaceExA
SetVolumeLabelA
GetVolumeInformationA
QueryDosDeviceW
QueryDosDeviceA
GetLogicalDrives
GetDriveTypeW
GetDriveTypeA
MoveFileExW
MoveFileExA
RemoveDirectoryW
CopyFileW
CreateDirectoryW
RemoveDirectoryA
CopyFileA
CreateDirectoryA
DeleteFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileA
GetFileAttributesA
SetFileAttributesA
GetEnvironmentVariableW
GetSystemDefaultLangID
OutputDebugStringW
GetExitCodeProcess
GetProcessTimes
FileTimeToSystemTime
OpenProcess
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
LoadLibraryA
GetCurrentProcess
CreateThread
GetTempPathW
GetTempPathA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
SetEndOfFile
GetSystemTime
QueryPerformanceCounter
GetExitCodeThread
GetFileAttributesExW
GetModuleHandleW
CreateFileA
GetFileInformationByHandle
CloseHandle
GetModuleHandleA
GetCurrentThreadId
WideCharToMultiByte
IsBadReadPtr
lstrlenA
LocalFree
FormatMessageA
LoadResource
FindResourceExA
GetACP
lstrlenW
FormatMessageW
GetVersionExA
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
SleepEx
InterlockedExchange
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
CreateEventA
SetEvent
PulseEvent
ResetEvent
WaitForMultipleObjects
GetLocalTime
WriteFile
SetFilePointer
FreeConsole
WriteConsoleA
GetStdHandle
AllocConsole
RtlUnwind
RaiseException
GetCommandLineA
HeapFree
HeapAlloc
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetCurrentThread
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
FatalAppExitA
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadCodePtr
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
GetLocaleInfoW
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenMutexA
GetSystemInfo
SuspendThread
ResumeThread
TerminateThread
SetPriorityClass
GetPriorityClass
SetThreadPriority
GetThreadPriority
ReadProcessMemory
CreateProcessA
InterlockedCompareExchange
InterlockedExchangeAdd
CreateProcessW
VirtualQueryEx
MoveFileA
MoveFileW
lstrcmpA
LocalAlloc
IsBadWritePtr
MultiByteToWideChar
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCurrentDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleFileNameA
GetSystemDirectoryA
VirtualQuery
VirtualProtect
GetLastError
GetModuleFileNameW
LoadLibraryW
GetProcAddress
GetTickCount
InterlockedDecrement
GetCurrentProcessId

user32

OpenDesktopA
GetThreadDesktop
SetThreadDesktop
CloseDesktop
MsgWaitForMultipleObjects
OpenInputDesktop
GetUserObjectInformationA
GetSystemMetrics
SendMessageW
SendMessageA
FindWindowExW
EnumChildWindows
GetWindowRect
CallWindowProcW
SetWindowLongW
GetParent
FindWindowExA
GetForegroundWindow
GetWindowLongW
GetCursorPos
WindowFromPoint
GetClassNameW
GetWindowTextW
GetWindowThreadProcessId
OpenClipboard
EmptyClipboard
CloseClipboard
EnumClipboardFormats
OemToCharBuffA
CharToOemBuffA
GetUserObjectInformationW
GetDesktopWindow
RegisterClipboardFormatW
IsWindow
MessageBoxA
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
GetProcessWindowStation
MessageBoxW

gdi32

DeleteDC
TextOutW
DeleteObject
GetBitmapBits
BitBlt
GetObjectA
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA

advapi32

RegCreateKeyExW
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegConnectRegistryA
SetSecurityDescriptorDacl
GetAce
LookupAccountNameW
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
LookupAccountSidW
GetTokenInformation
SetFileSecurityA
RegSetKeySecurity
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
DeregisterEventSource
ReportEventA
RegisterEventSourceA

shell32

DragQueryFileW

oleaut32

VariantCopy
SysFreeString
SysStringLen
VariantInit

ws2_32

WSAGetLastError

oleacc

AccessibleObjectFromPoint
AccessibleObjectFromWindow

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

TAuxModCallNext
TAuxModIsStart
TAuxModQuery
TAuxModRegister
TAuxModResetCallbackDataCache
TAuxModSetDtFrame
TAuxModSetHookInterfaceType
TAuxModStart
TAuxModStop
TAuxModUnRegister
TCbdGetRealClipboardData
TCbdGetTransfer
TCbdGetTransferFormat
TCbdIsMarkup
TCbdIsStart
TCbdMarkup
TCbdQuery
TCbdRegister
TCbdResetCallbackDataCache
TCbdSetTransfer
TCbdStart
TCbdStop
TCbdUnRegister
TDdpReplaceObjectData
TLPChangeStatus
TLPCheckCache
TLPPARegister
TLPPAUnRegister
TLPRegister
TLPStart
TLPStop
TLPUnRegister
TSptIsStart
TSptQuery
TSptRegister
TSptResetCallbackDataCache
TSptStart
TSptStop
TSptUnRegister
TUodIsTraceDoc
TUodIsWndMin
TUodQueryAllDocInfo
TUodQueryAllDocWnd
TUodQueryDocWndFile
TUodQueryWndFile
TUodSetProcExt

Sections

.text
Size: 708KB - Virtual size: 705KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a8268af9be8d31e489636d3f3824b44

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

oleaut32

ws2_32

oleacc

version

Exports

Exports

Sections

.text Size: 708KB - Virtual size: 705KB

.rdata Size: 80KB - Virtual size: 78KB

.data Size: 208KB - Virtual size: 282KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 52KB - Virtual size: 50KB

.text
Size: 708KB - Virtual size: 705KB

.rdata
Size: 80KB - Virtual size: 78KB

.data
Size: 208KB - Virtual size: 282KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 52KB - Virtual size: 50KB