2d3910f170bedcc3f056f07111f6915925ad1ab9744a3987b261a84a41d2c391

Sharing

Copy URL

Twitter E-mail

General

Target

2d3910f170bedcc3f056f07111f6915925ad1ab9744a3987b261a84a41d2c391
Size

962KB
MD5

1a10874a220af1693592a83703f4ffd6
SHA1

5f1ad65cf34bafd5e48b72323dc93e16a58e4724
SHA256

2d3910f170bedcc3f056f07111f6915925ad1ab9744a3987b261a84a41d2c391
SHA512

5f8fd6ff3a65020cd4d6a913c362ccb2ea31268aa37cb6b248aac119c53890ad3992a593ec11f56c605947cfe3b5a5af90e093ad6a7e19f5330adb8c07038fb2
SSDEEP

12288:GQY+7+Sk1XfUjBKIIweB6ktmGPplZnQoM5YuYcwCX/Wia5Xv0LxqSfu:ZY+7+F1vUjBKIGXTP9LuRw42iUS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d3910f170bedcc3f056f07111f6915925ad1ab9744a3987b261a84a41d2c391

Files

2d3910f170bedcc3f056f07111f6915925ad1ab9744a3987b261a84a41d2c391
.dll windows:6 windows x86 arch:x86

ef20fcd8b151499ab0a578f625447461

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Jenkins\workspace\Customers\SDK\CreatePartnerSdkPackage\MorphiApi\ReleaseDLL\MorphiApi32.pdb

Imports

kernel32

ReleaseSRWLockShared
GetModuleFileNameW
InitializeCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
VirtualQuery
GetFullPathNameW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
K32EnumProcessModulesEx
OpenThread
ReadProcessMemory
DuplicateHandle
GetCurrentProcess
GetFileInformationByHandle
GetBinaryTypeW
ProcessIdToSessionId
GetSystemTime
SystemTimeToFileTime
TryAcquireSRWLockExclusive
K32GetModuleFileNameExW
GetTimeZoneInformation
GetComputerNameW
GetTickCount64
WaitForSingleObjectEx
GetCurrentProcessId
ResetEvent
WaitForMultipleObjectsEx
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
GetCurrentThreadId
lstrcmpA
LoadLibraryW
SetLastError
GetOverlappedResult
CancelIo
EnterCriticalSection
ResumeThread
VirtualAlloc
VirtualFree
GetWindowsDirectoryW
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
CreateRemoteThread
GetCurrentThread
GetExitCodeThread
VirtualQueryEx
WriteProcessMemory
VirtualFreeEx
GetCurrentDirectoryW
CreateFileA
ExitProcess
TerminateProcess
CreateProcessA
CreateProcessW
GetTickCount
GetSystemDirectoryW
CreatePipe
ReleaseSemaphore
ReleaseMutex
CreateMutexW
ReleaseSRWLockExclusive
SetThreadPriority
FreeLibrary
GetModuleHandleA
LoadLibraryA
lstrcpyA
lstrcatA
lstrlenA
IsBadReadPtr
CreateEventExW
CreateFileMappingA
GetModuleFileNameA
ExitThread
FlushInstructionCache
OpenMutexW
OpenEventW
OpenFileMappingW
GetThreadContext
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
AcquireSRWLockShared
AcquireSRWLockExclusive
TerminateThread
WaitForSingleObject
GetFinalPathNameByHandleW
IsWow64Process
GetNativeSystemInfo
CreateEventW
VirtualProtectEx
VirtualAllocEx
GetFileTime
FileTimeToSystemTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetProcAddress
SetThreadpoolTimer
GetModuleHandleW
GetProcessTimes
GetFileSize
MoveFileExW
LocalAlloc
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelIoEx
CancelThreadpoolIo
DeviceIoControl
StartThreadpoolIo
CreateThreadpoolIo
GetFileInformationByHandleEx
GetFileType
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
LocalFree
Sleep
MoveFileW
SetEndOfFile
SetFilePointer
WriteFile
ReadFile
CreateFileW
CreateDirectoryW
CloseHandle
QueryFullProcessImageNameW
OpenProcess
K32EnumProcesses
FindClose
WaitForMultipleObjects
FindNextFileW
GetACP
IsValidCodePage
SetFilePointerEx
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateThread
FindFirstFileExW
CopyFileW
GetFileAttributesW
QueryDosDeviceW
GetLogicalDrives
VerSetConditionMask
VerifyVersionInfoW
SetEvent
GetLastError
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CreateSemaphoreW
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
SwitchToThread
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
VirtualProtect

user32

TranslateMessage
DispatchMessageW
PeekMessageW
wsprintfW
OpenInputDesktop
CloseDesktop
GetThreadDesktop
GetUserObjectInformationA
MsgWaitForMultipleObjects

advapi32

ConvertSidToStringSidW
OpenServiceW
CloseServiceHandle
NotifyServiceStatusChangeW
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegSetKeyValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
OpenProcessToken
GetTokenInformation
GetKernelObjectSecurity
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
StartServiceW
QueryServiceStatus
QueryServiceConfigW
DeleteService
CreateServiceW
ControlService
ChangeServiceConfigW
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
RegDeleteValueA
RegDeleteKeyW
GetSidSubAuthorityCount
GetSidSubAuthority
LookupAccountSidW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
SystemFunction036
QueryServiceStatusEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
IsValidSid
OpenSCManagerW

shell32

CommandLineToArgvW

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

ntdll

RtlComputeCrc32
RtlImageRvaToVa
RtlImageDirectoryEntryToData
NtQueryVirtualMemory
NtQueryInformationProcess

userenv

GetProfilesDirectoryW

shlwapi

PathIsDirectoryW
PathFileExistsW

dbghelp

ImageRvaToVa
ImageDirectoryEntryToDataEx
ImageNtHeader
MiniDumpWriteDump

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData

crypt32

CryptBinaryToStringW
CryptBinaryToStringA
CryptProtectData
CryptUnprotectData
CertGetNameStringW
CryptStringToBinaryA
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptDecodeObject
CryptQueryObject

wintrust

WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

Exports

Exports

DeInitializeMorphisecInstance
GetApiControl
InitializeMorphisecInstance
SetMorphisecOption
StartMorphisecInstance
StopMorphisecInstance

Sections

.text
Size: 725KB - Virtual size: 725KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef20fcd8b151499ab0a578f625447461

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ntdll

userenv

shlwapi

dbghelp

version

secur32

crypt32

wintrust

Exports

Exports

Sections

.text Size: 725KB - Virtual size: 725KB

.rdata Size: 186KB - Virtual size: 186KB

.data Size: 11KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 725KB - Virtual size: 725KB

.rdata
Size: 186KB - Virtual size: 186KB

.data
Size: 11KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 35KB