67597cda4022a9ccce3b7ec89b11efe0f79ef9654ca1dd733c5c7d9271bc34b4

Sharing

Copy URL Twitter E-mail

General

Target

67597cda4022a9ccce3b7ec89b11efe0f79ef9654ca1dd733c5c7d9271bc34b4
Size

812KB
MD5

d8f7fc58f9f8ab3c0b36890d4ebf2bca
SHA1

278cdb72c9b4f22b4c17fbd410dcfbb1cd92aa30
SHA256

67597cda4022a9ccce3b7ec89b11efe0f79ef9654ca1dd733c5c7d9271bc34b4
SHA512

664ee6917cd9b0fa43ea892dc4e622343d3c04b01da121add8a2e4eeaf223d7dea51519a9864f3826e5dde1ac6f1ce9f85fa3c8498aab2e90c993c064dc14384
SSDEEP

24576:cVQnDR9wUJSIAgGwYZPLwZ5vJLK52+Sv:cKnDR91UggFLwZ5vJLK52+Sv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67597cda4022a9ccce3b7ec89b11efe0f79ef9654ca1dd733c5c7d9271bc34b4

Files

67597cda4022a9ccce3b7ec89b11efe0f79ef9654ca1dd733c5c7d9271bc34b4
.dll windows:10 windows x64 arch:x64

e41206ca7aeab68e9d59e46fe4ab70ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

iphlpsvc.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcscmp
wcsncmp
wcsnlen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
_o__invalid_parameter_noinfo
_o__wcsicmp
_o__wcsnicmp
memmove
_o__initialize_onexit_table
_o__wtoi
_o_free
_o_malloc
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
__CxxFrameHandler3
_CxxThrowException
_o__initialize_narrow_environment
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler4
wcsstr
wcschr
__C_specific_handler
__C_specific_handler_noexcept
memcmp
memcpy

api-ms-win-core-perfcounters-l1-1-0

PerfSetCounterRefValue
PerfStartProviderEx
PerfSetCounterSetInfo
PerfStopProvider
PerfSetULongCounterValue
PerfSetULongLongCounterValue
PerfDeleteInstance
PerfCreateInstance

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteTreeW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExA
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegGetValueW
RegDeleteKeyExW

ntdll

RtlIpv4AddressToStringW
RtlIpv4StringToAddressW
RtlGetDeviceFamilyInfoEnum
RtlIpv6StringToAddressW
WinSqmIncrementDWORD
EtwEventActivityIdControl
RtlIpv6AddressToStringW
RtlRemoveEntryHashTable
RtlDeleteHashTable
RtlIsStateSeparationEnabled
RtlLookupEntryHashTable
RtlGetNextEntryHashTable
RtlInitEnumerationHashTable
RtlEnumerateEntryHashTable
RtlEndEnumerationHashTable
RtlCreateHashTable
WinSqmSetIfMaxDWORD
RtlIpv4StringToAddressExW
RtlGetVersion
RtlNtStatusToDosError
RtlInsertEntryHashTable

iphlpapi

NotifyIpInterfaceChange
ConvertInterfaceGuidToLuid
GetIfEntry2
GetIpForwardTable2
FreeMibTable
ConvertInterfaceLuidToAlias
InternalSetTeredoPort
ConvertInterfaceLuidToGuid
ConvertGuidToStringA
ConvertStringToGuidW
GetIfTable2
Icmp6CreateFile
Icmp6SendEcho2
IcmpCloseHandle
GetUnicastIpAddressTable
GetIpNetEntry2
SetCurrentThreadCompartmentId
ResolveIpNetEntry2
GetBestRoute2
GetBestInterfaceEx
GetIpAddrTable
InitializeIpInterfaceEntry
InternalSetIpInterfaceEntry
GetBestInterface
ConvertCompartmentIdToGuid
GetUnicastIpAddressEntry
NotifyUnicastIpAddressChange
ConvertGuidToStringW
GetAdaptersAddresses
ConvertInterfaceIndexToLuid
ParseNetworkString
ConvertInterfaceLuidToIndex
CancelMibChangeNotify2
GetIpForwardEntry2
NotifyRouteChange2
InitializeIpForwardEntry
GetIpInterfaceTable
CreateIpForwardEntry2
DeleteIpForwardEntry2

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCompareMemory
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-interlocked-l1-1-0

QueryDepthSList
InterlockedPopEntrySList
InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapDestroy
HeapCreate
GetProcessHeap

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
SetEvent
ReleaseMutex
WaitForMultipleObjectsEx
ResetEvent
TryAcquireSRWLockExclusive
CreateEventExW
CreateMutexW
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
OpenEventW
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
CreateEventW
WaitForSingleObject
InitializeCriticalSection

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
CreateWellKnownSid
CheckTokenMembership
FreeSid

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CreateFileW
SetEndOfFile
ReadFile
WriteFile
GetFileInformationByHandle

api-ms-win-core-io-l1-1-0

DeviceIoControl
CancelIoEx

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
SizeofResource
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
LoadResource
FindResourceExW
LoadStringW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
CreateThreadpool
SetThreadpoolWait
CloseThreadpoolCleanupGroup
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolIo
CloseThreadpoolIo
CloseThreadpoolWork
SubmitThreadpoolWork
CloseThreadpool
CreateThreadpoolWork
StartThreadpoolIo
CancelThreadpoolIo
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
BindIoCompletionCallback

api-ms-win-core-memory-l1-1-2

VirtualAllocExNuma

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
DeleteProcThreadAttributeList
TerminateProcess
GetCurrentThread
CreateRemoteThreadEx
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-memory-l1-1-0

VirtualFree

api-ms-win-core-processtopology-obsolete-l1-1-1

GetActiveProcessorGroupCount

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetActiveProcessorCount

api-ms-win-core-kernel32-legacy-l1-1-1

GetNumaProcessorNodeEx

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx

api-ms-win-core-processtopology-l1-1-0

SetThreadGroupAffinity

mswsock

AcceptEx
GetAcceptExSockaddrs

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

rpcrt4

RpcServerRegisterIfEx
RpcServerUseProtseqW
RpcServerUnregisterIfEx
RpcServerRegisterIf3
RpcEpRegisterW
RpcImpersonateClient
RpcServerInqBindings
RpcRevertToSelf
RpcRevertToSelfEx
RpcEpUnregister
I_RpcBindingInqLocalClientPID
RpcBindingVectorFree
RpcServerUseProtseqIfW
NdrServerCall2
UuidCreate
NdrServerCallAll

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

fwpuclnt

FwpmTransactionCommit0
FwpmFilterDeleteById0
FwpmFilterEnum0
FwpmFilterCreateEnumHandle0
FwpmTransactionAbort0
FwpmTransactionBegin0
FwpmFilterAdd0
FwpmSubLayerAdd0
FwpmFilterDestroyEnumHandle0
FwpmEngineOpen0
FwpmFilterUnsubscribeChanges0
FwpmProviderDeleteByKey0
FwpmFilterSubscribeChanges0
FwpmProviderAdd0
FwpmFilterGetByKey0
FwpmEngineClose0
FwpmFreeMemory0

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-xstate-l2-1-0

GetEnabledXStateFeatures

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

IphlpsvcSysprepGeneralize
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 452KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e41206ca7aeab68e9d59e46fe4ab70ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-perfcounters-l1-1-0

api-ms-win-core-registry-l1-1-0

ntdll

iphlpapi

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-1

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-l1-1-0

mswsock

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

rpcrt4

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

fwpuclnt

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-xstate-l2-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 452KB - Virtual size: 448KB

.rdata Size: 256KB - Virtual size: 252KB

.data Size: 8KB - Virtual size: 18KB

.pdata Size: 20KB - Virtual size: 19KB

.didat Size: 4KB - Virtual size: 1KB

.rsrc Size: 64KB - Virtual size: 60KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 452KB - Virtual size: 448KB

.rdata
Size: 256KB - Virtual size: 252KB

.data
Size: 8KB - Virtual size: 18KB

.pdata
Size: 20KB - Virtual size: 19KB

.didat
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 64KB - Virtual size: 60KB

.reloc
Size: 4KB - Virtual size: 1KB