310dae486f2acf70b317e0fe719acb2b82b1da4ad061aeb14562a1a6e1cb0bcd

Sharing

Copy URL Twitter E-mail

General

Target

310dae486f2acf70b317e0fe719acb2b82b1da4ad061aeb14562a1a6e1cb0bcd
Size

1.4MB
MD5

029e2fce57deacad651b278ba01a1927
SHA1

66ce5a0d141cdde3c93582bcaaf9053ec1c5ca87
SHA256

310dae486f2acf70b317e0fe719acb2b82b1da4ad061aeb14562a1a6e1cb0bcd
SHA512

b6ca506558a8f0f317792d45ede4cf3a3408c87d1be5402aaaee415418f0eede078cadb7ed5dd72becdc4e11f722e875cb6ffa37976cb204e07fc06fe206d44c
SSDEEP

24576:B3a4RYfasMljjy+5Xj+eMZ0S0WJ6pT0j0JSFkdB9bdjISdjYMvbrIwecEYDU7g:UyjjyeSriS0WJ6pB2kBvbrIGEOU7g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
310dae486f2acf70b317e0fe719acb2b82b1da4ad061aeb14562a1a6e1cb0bcd

Files

310dae486f2acf70b317e0fe719acb2b82b1da4ad061aeb14562a1a6e1cb0bcd
.dll windows:5 windows x64 arch:x64

ec30ccc72d80660f5bc4e26a40be0328

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\WorkshopAgent\DevelopProj2\BroHookAPI\20230227_IPG-28195_Base4.74.1102.0\BroHookAPI\Bin\Release\winbrohca64.pdb

Imports

ws2_32

WSAGetLastError

kernel32

LocalFree
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetSystemInfo
RemoveDirectoryW
lstrcmpW
SetFileAttributesW
MoveFileW
MoveFileExW
GetFileAttributesExW
CreateMutexW
OpenMutexW
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
CreateFileMappingW
GetVersionExW
GetWindowsDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryW
GetCommandLineW
GetStdHandle
WriteFile
GetFileSize
OutputDebugStringA
FreeConsole
AllocConsole
CreateSemaphoreW
GetCurrentProcess
SetEvent
PulseEvent
ResetEvent
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetModuleHandleA
GetFileInformationByHandle
Sleep
WideCharToMultiByte
GetModuleHandleW
GetFileAttributesW
SetFilePointer
MultiByteToWideChar
GetPrivateProfileStringW
GetExitCodeThread
ReleaseMutex
CreateMutexA
SetEndOfFile
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
IsBadWritePtr
GetCurrentThreadId
LoadLibraryW
GetProcAddress
FreeLibrary
WaitForSingleObject
QueryDosDeviceA
GetDriveTypeA
DefineDosDeviceW
GetDiskFreeSpaceExW
SetVolumeLabelW
GetVolumeInformationW
GetLogicalDrives
GetDriveTypeW
LoadLibraryA
VirtualQueryEx
GetProfileStringW
OutputDebugStringW
ReleaseSemaphore
GetEnvironmentVariableW
OpenProcess
CompareFileTime
GetProcessHeap
CopyFileW
GetTickCount
CreateFileW
ReadFile
CloseHandle
CreateEventW
GetLocalTime
DeleteFileW
GetLogicalDriveStringsW
lstrcmpiW
QueryDosDeviceW
lstrlenW
lstrcpyW
lstrcatW
GetModuleFileNameW
GetSystemDirectoryW
GetLastError
WriteConsoleW
GetExitCodeProcess
GetThreadPriority
SetThreadPriority
GetPriorityClass
SetPriorityClass
TerminateThread
ResumeThread
GetEnvironmentVariableA
GetTempPathW
GetTempPathA
SuspendThread
CreateProcessW
CreateProcessA
ExpandEnvironmentStringsW
lstrlenA
LoadResource
FindResourceExW
FormatMessageA
GetACP
FormatMessageW
SleepEx
FileTimeToSystemTime
FileTimeToLocalFileTime
IsBadReadPtr
LoadLibraryExW
FreeResource
EnumResourceTypesW
EnumResourceNamesW
EnumResourceLanguagesW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
SetLastError
VirtualQuery
LockResource
SizeofResource
CreateFileMappingA
GetFileAttributesA
VirtualProtect
RtlLookupFunctionEntry
RtlUnwindEx
EncodePointer
DecodePointer
RaiseException
RtlPcToFileHeader
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
GetDateFormatW
GetTimeFormatW
FlsSetValue
GetCommandLineA
FlsGetValue
FlsFree
GetCurrentThread
FlsAlloc
GetCPInfo
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
HeapFree
HeapSize
ExitProcess
HeapAlloc
GetTimeZoneInformation
LCMapStringW
GetStringTypeW
GetLocaleInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetCurrentDirectoryW
SetFileAttributesA
DeleteFileA
MoveFileA
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
MoveFileExA
CopyFileA
ExpandEnvironmentStringsA

user32

IsWindow
GetForegroundWindow
GetWindowThreadProcessId
GetWindowRect
GetClassNameW
FindWindowW
MsgWaitForMultipleObjects
GetDlgCtrlID
GetDesktopWindow
InternalGetWindowText
GetWindowTextA
IsWindowVisible
GetParent
EnumDesktopWindows
MessageBoxW
wsprintfW
GetSystemMetrics
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
GetWindowLongW
GetUserObjectInformationW
OpenInputDesktop
OpenDesktopW
GetThreadDesktop
SetThreadDesktop
CloseDesktop
EnumChildWindows
RegisterWindowMessageW
FindWindowExW
GetProcessWindowStation
SendMessageTimeoutW
GetDC
SendMessageW
WindowFromDC
EnumWindows
GetWindowTextW

gdi32

CreateCompatibleBitmap
GetViewportOrgEx
GetWindowOrgEx
DeleteDC
DeleteObject
GetBitmapBits
BitBlt
GetObjectW
SelectObject
GetDeviceCaps
CreateCompatibleDC
CreateDCW

advapi32

AddAccessAllowedAce
RegisterEventSourceW
GetUserNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExA
RegQueryValueExW
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExA
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
RegConnectRegistryW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExA
RegEnumValueW
RegCreateKeyA
RegCreateKeyExA
SetFileSecurityW
RegSetKeySecurity
DeregisterEventSource
ReportEventW

ole32

CoInitializeEx
CoInitialize
CoUninitialize

oleaut32

SysStringLen
SysFreeString
VariantInit
DosDateTimeToVariantTime

oleacc

AccessibleObjectFromWindow
ObjectFromLresult

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

BrowserHAInit
CheckHistoryFile
CheckHistoryPath
CheckHistoryPathAfter
CheckHistoryReg
CloseInvisibleBrowser
ControlBrowserInvisible
CopyData
GetBrowserCfgFilePath
GetBrowserCfgFilePath2
GetConfigUrllogMode
GetSBUrlIACC
GetSBUrlIACC2
GetUpDownLoadRecordMode
GetUrlByFileName
GetUrlByWnd
GetUrlData
GetWnd
INJInstallDetours
INJUninstallDetours
InitIMHookAPIShareMem
InstallDetours
InstallDetoursOne
IsBrowserHAInited
IsBrowserNeedtoHook
IsHistoryPath
IsLogFilePath
IsUrlBrowserApp
LoadSQLLib
LocalInit
LocalUnInit
QueryUrlByTitle
SetFlags
SetFunctionCode
SetStatus
SyncBrowserWnd
TGetLogConfig
TSetLogConfig
UninstallDetours
UninstallDetoursOne

Sections

.text
Size: 850KB - Virtual size: 850KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 343KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IMHookA
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLCONFIG
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec30ccc72d80660f5bc4e26a40be0328

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

oleacc

version

Exports

Exports

Sections

.text Size: 850KB - Virtual size: 850KB

.rdata Size: 343KB - Virtual size: 342KB

.data Size: 78KB - Virtual size: 134KB

.pdata Size: 61KB - Virtual size: 61KB

.IMHookA Size: 81KB - Virtual size: 80KB

TLCONFIG Size: 1024B - Virtual size: 536B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 850KB - Virtual size: 850KB

.rdata
Size: 343KB - Virtual size: 342KB

.data
Size: 78KB - Virtual size: 134KB

.pdata
Size: 61KB - Virtual size: 61KB

.IMHookA
Size: 81KB - Virtual size: 80KB

TLCONFIG
Size: 1024B - Virtual size: 536B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB