2fd27eddbfe17c59f45227478dc99532228b27f4f9e508f686254abf09178b06

Sharing

Copy URL Twitter E-mail

General

Target

2fd27eddbfe17c59f45227478dc99532228b27f4f9e508f686254abf09178b06
Size

580KB
MD5

1599ef1d7e69062a76e403e3a23d1d4e
SHA1

24d2b632952c6b9aa637fa83e39c63b577c9ccff
SHA256

2fd27eddbfe17c59f45227478dc99532228b27f4f9e508f686254abf09178b06
SHA512

85344caf3e3c3b0da24ba12596bc0e561d15a9c1722e736c8202b773cccf85b048e5f99e2191f954dd4929e266da9aed38bc8303df66d27808c61f4e34d0b6dc
SSDEEP

12288:rpVaB6wIndIYIdRAZsXjDELjptXEflyGH4tLQQSrDVX/4tIZ4ARxegBLuQAd4LYL:re8eRAZsXjDELjptXEflyGH4tLQQSrDO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fd27eddbfe17c59f45227478dc99532228b27f4f9e508f686254abf09178b06

Files

2fd27eddbfe17c59f45227478dc99532228b27f4f9e508f686254abf09178b06
.dll regsvr32 windows:4 windows x64 arch:x64

a052e9497389c830f6a7cd671b6384c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
DelayLoadFailureHook
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumResourceNamesW
FindResourceW
FreeLibrary
GetDriveTypeW
GetEnvironmentVariableW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetTempFileNameW
GetTempPathW
GetTickCount
GetVersionExW
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceExecuteOnce
InitializeCriticalSection
IsBadStringPtrA
IsBadStringPtrW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryW
ResolveDelayLoadedAPI
RtlUnwind
SetFilePointerEx
SizeofResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
lstrcmpiW

ntdll

RtlIpv6AddressToStringExW
RtlIpv6StringToAddressW
_vsnprintf

ole32

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoMarshalInterface
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUnmarshalInterface
CreateBindCtx
CreateGenericComposite
CreateStreamOnHGlobal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
MkParseDisplayName
ReleaseStgMedium
STGMEDIUM_UserFree
STGMEDIUM_UserMarshal
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
StringFromCLSID

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree

rpcrt4

CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrAllocate
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrClearOutParameters
NdrConformantArrayBufferSize
NdrConformantArrayFree
NdrConformantArrayMarshall
NdrConformantArrayUnmarshall
NdrConformantStringBufferSize
NdrConformantStringMarshall
NdrConformantStringUnmarshall
NdrConformantStructBufferSize
NdrConformantStructMarshall
NdrConformantStructUnmarshall
NdrConvert
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
NdrOleAllocate
NdrOleFree
NdrPointerBufferSize
NdrPointerFree
NdrPointerMarshall
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrProxyFreeBuffer
NdrProxyGetBuffer
NdrProxyInitialize
NdrProxySendReceive
NdrSimpleStructMarshall
NdrSimpleStructUnmarshall
NdrSimpleTypeMarshall
NdrSimpleTypeUnmarshall
NdrStubGetBuffer
NdrStubInitialize
NdrUserMarshalBufferSize
NdrUserMarshalMarshall
NdrUserMarshalUnmarshall
RpcRaiseException

shell32

ShellExecuteExW

shlwapi

ord2
PathCreateFromUrlW
PathFindExtensionW
StrChrW
StrCmpNIW
StrCmpNW
UrlCanonicalizeW
UrlCombineW
UrlCompareW
UrlGetPartW
UrlUnescapeW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_assert
_recalloc
_strdup
_wcsdup
_wcsicmp
_wcsnicmp
calloc
free
fwrite
getenv
iswalpha
iswcntrl
iswspace
iswupper
malloc
memcmp
memcpy
memmove
memset
realloc
strchr
strcmp
strcspn
strlen
towlower
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcstol

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
DialogBoxParamW
DispatchMessageW
EnableWindow
EndDialog
GetDlgItem
GetPropW
KillTimer
LoadIconW
LoadStringW
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
RegisterClassExW
RegisterClipboardFormatW
SendDlgItemMessageW
SetDlgItemTextW
SetPropW
SetTimer
TranslateMessage
UnregisterClassW
wsprintfW

wininet

CommitUrlCacheEntryW
CreateUrlCacheEntryW
FtpGetFileSize
HttpEndRequestW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetErrorDlg
InternetLockRequestFile
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
InternetUnlockRequestFile
InternetWriteFile

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIUriPriv
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IEInstallScope
IsAsyncMoniker
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldShowIntranetWarningSecband
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 344KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 504B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a052e9497389c830f6a7cd671b6384c2

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

ucrtbase

user32

wininet

Exports

Exports

Sections

.text Size: 344KB - Virtual size: 340KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 4KB - Virtual size: 2KB

.rdata Size: 104KB - Virtual size: 102KB

/4 Size: 4KB - Virtual size: 488B

.pdata Size: 16KB - Virtual size: 14KB

.xdata Size: 16KB - Virtual size: 13KB

.bss Size: - Virtual size: 504B

.edata Size: 8KB - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 10KB

.rsrc Size: 60KB - Virtual size: 58KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 344KB - Virtual size: 340KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 4KB - Virtual size: 2KB

.rdata
Size: 104KB - Virtual size: 102KB

/4
Size: 4KB - Virtual size: 488B

.pdata
Size: 16KB - Virtual size: 14KB

.xdata
Size: 16KB - Virtual size: 13KB

.bss
Size: - Virtual size: 504B

.edata
Size: 8KB - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 60KB - Virtual size: 58KB

.reloc
Size: 4KB - Virtual size: 2KB