18e12eb2e734d49d11762af06ad0806503477dc5b9db2fc0d42dde146bf78ddb

Sharing

Copy URL Twitter E-mail

General

Target

18e12eb2e734d49d11762af06ad0806503477dc5b9db2fc0d42dde146bf78ddb
Size

914KB
MD5

cad5ba538cd1632915b9a3b6ad00e5c4
SHA1

f6b83758ee858f94c4c40ad5cbc1231881324b72
SHA256

18e12eb2e734d49d11762af06ad0806503477dc5b9db2fc0d42dde146bf78ddb
SHA512

88d874e110c562193d74e841a4593d3fa17b5441be81ebf0f80b932180e2f97af3bace7e0aa0e477f63828893386d1652da53353dd9c98079bb20e7a026e5f4e
SSDEEP

6144:SEf4BFNI1JfM9dlVqjEMv4Ckr9R92mrlrJEINHyrojdEZy8yfzKSSdm1NwBmqyTF:R4BFNI1V09WaJEINHyrojdEZS1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18e12eb2e734d49d11762af06ad0806503477dc5b9db2fc0d42dde146bf78ddb

Files

18e12eb2e734d49d11762af06ad0806503477dc5b9db2fc0d42dde146bf78ddb
.dll regsvr32 windows:10 windows x64 arch:x64

31468dc375bb32e78a84a4e125e0143b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

IEProxy.pdb

Imports

msvcrt

malloc
memcmp
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
free
memcpy
memcpy_s
_purecall
_vsnwprintf
wcsstr
__CxxFrameHandler3
wcschr
_callnewh
memset

rpcrt4

NdrGetUserMarshalInfo
RpcRaiseException
NdrStubCall3
NdrClientCall3
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrCStdStubBuffer2_Release
CStdStubBuffer_Disconnect
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExA

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-rtcore-ntuser-window-l1-1-0

PostMessageW
SendMessageTimeoutW
FindWindowExW
AllowSetForegroundWindow
GetWindowThreadProcessId

api-ms-win-downlevel-shlwapi-l2-1-0

IUnknown_QueryService

api-ms-win-downlevel-shlwapi-l1-1-0

PathCreateFromUrlW

api-ms-win-downlevel-advapi32-l1-1-0

GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorDacl
GetAce
GetKernelObjectSecurity
GetSidIdentifierAuthority

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient21
ObjectStublessClient24
ObjectStublessClient4
ObjectStublessClient25
ObjectStublessClient28
ObjectStublessClient31
ObjectStublessClient30
ObjectStublessClient29
CStdAsyncStubBuffer_Release
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Invoke
ObjectStublessClient26
ObjectStublessClient19
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient17
ObjectStublessClient12
ObjectStublessClient16
NdrProxyForwardingFunction7
NdrProxyForwardingFunction12
NdrProxyForwardingFunction9
ObjectStublessClient9
NdrProxyForwardingFunction10
ObjectStublessClient8
NdrProxyForwardingFunction13
NdrProxyForwardingFunction11
ObjectStublessClient7
NdrProxyForwardingFunction6
NdrProxyForwardingFunction8
NdrProxyForwardingFunction14
CStdStubBuffer2_Connect
CStdAsyncStubBuffer_QueryInterface
NdrProxyForwardingFunction3
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Disconnect
CStdStubBuffer2_CountRefs
ObjectStublessClient22

api-ms-win-core-marshal-l1-1-0

HWND_UserUnmarshal
HWND_UserFree
HWND_UserSize
HWND_UserUnmarshal64
HWND_UserSize64
HWND_UserMarshal64
HWND_UserMarshal
HWND_UserFree64
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal64
HMENU_UserUnmarshal
HMENU_UserFree
HGLOBAL_UserFree64
HMENU_UserUnmarshal64
HMENU_UserSize64
HMENU_UserSize
HMENU_UserMarshal64
HMENU_UserFree64
HICON_UserUnmarshal
HICON_UserMarshal64
HICON_UserMarshal
HICON_UserUnmarshal64
HICON_UserFree
HICON_UserSize64
HICON_UserSize
HICON_UserFree64
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserMarshal64
HMENU_UserMarshal
HBITMAP_UserSize
HBITMAP_UserFree64
HBITMAP_UserMarshal
HBITMAP_UserSize64
HBITMAP_UserUnmarshal
HBITMAP_UserUnmarshal64
HBITMAP_UserFree
HBITMAP_UserMarshal64
HGLOBAL_UserUnmarshal
HGLOBAL_UserSize64

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-file-l1-1-0

CreateFileW
GetFinalPathNameByHandleW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-url-l1-1-0

PathIsURLW
UrlCanonicalizeW
ParseURLW
UrlCreateFromPathW
UrlApplySchemeW

api-ms-win-ole32-ie-l1-1-0

ReleaseStgMedium

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 765KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31468dc375bb32e78a84a4e125e0143b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-downlevel-shlwapi-l2-1-0

api-ms-win-downlevel-shlwapi-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-marshal-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-ole32-ie-l1-1-0

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 765KB - Virtual size: 765KB

.data Size: 22KB - Virtual size: 23KB

.pdata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 416B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 72KB - Virtual size: 71KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 765KB - Virtual size: 765KB

.data
Size: 22KB - Virtual size: 23KB

.pdata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 416B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 72KB - Virtual size: 71KB