8606c5ce69e7c87071ec66c7a8aebb8d2405318d0ecda20c5895eaa88b76a4f0

Sharing

Copy URL Twitter E-mail

General

Target

8606c5ce69e7c87071ec66c7a8aebb8d2405318d0ecda20c5895eaa88b76a4f0
Size

180KB
MD5

f7f00a7cea758e88a0555c50e0838129
SHA1

9964ebf36a2491d8194bcccdbc4386ab30949aef
SHA256

8606c5ce69e7c87071ec66c7a8aebb8d2405318d0ecda20c5895eaa88b76a4f0
SHA512

4b135a9586790226aaec1b403288d74c7677088f6882751d7856c07c4c2e3c596e2927690228bcc4afc68654830ccc75c6f9b2a1f0ada5894615043b47aa8459
SSDEEP

3072:7ofOxqIvGaie8xWqEpsFvptM950OU9xjLibZTBfKabXXD0cB:70OwXksFxtM958tETBCabXXI2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8606c5ce69e7c87071ec66c7a8aebb8d2405318d0ecda20c5895eaa88b76a4f0

Files

8606c5ce69e7c87071ec66c7a8aebb8d2405318d0ecda20c5895eaa88b76a4f0
.dll windows:4 windows x64 arch:x64

355293c917a80f86c1ec9d25889dfa7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateFileW
DeleteCriticalSection
EnterCriticalSection
FlushFileBuffers
GetFileSize
GetLastError
GetStdHandle
GetSystemInfo
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
PeekConsoleInputA
ReadConsoleInputA
ReadFile
SetFilePointer
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile

msvcrt

__iob_func
_amsg_exit
_errno
_filelengthi64
_fileno
_fstat64
_get_osfhandle
_initterm
_lock
_lseeki64
_stat64
_time64
_unlock
_vscprintf
_vsnprintf
_wopen
abort
calloc
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fread
free
fseek
fsetpos
ftell
fwrite
getenv
islower
isspace
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
qsort_s
rand
realloc
rewind
srand
sscanf
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strtoul
tolower
toupper
vfprintf
wcstombs
_write
_unlink
_umask
_read
_putenv
_open
_lseek
_fdopen
_close
_access

ws2_32

select

Exports

Exports

ARMT_Convert
ARM_Convert
AlignOffsetAlloc_CreateVTable
BigAlloc
BigFree
BraState_SetFromMethod
CPU_IsSupported_AES
CPU_IsSupported_AVX2
CPU_IsSupported_PageGB
CPU_IsSupported_SHA
CPU_IsSupported_SSE41
CPU_IsSupported_SSSE3
CPU_IsSupported_VAES_AVX2
CPU_Is_InOrder
Crc64Calc
Crc64GenerateTable
Crc64Update
CrcCalc
CrcGenerateTable
CrcUpdate
CrcUpdateT1
CrcUpdateT4
CrcUpdateT8
Delta_Decode
Delta_Encode
Delta_Init
FileInStream_CreateVTable
FileOutStream_CreateVTable
FileSeqInStream_CreateVTable
File_Close
File_Construct
File_GetLength
File_Read
File_Seek
File_Write
IA64_Convert
InFile_Open
InFile_OpenW
LookInStream_LookRead
LookInStream_Read
LookInStream_Read2
LookInStream_SeekTo
LookToRead2_CreateVTable
Lzma2Dec_Allocate
Lzma2Dec_AllocateProbs
Lzma2Dec_DecodeToBuf
Lzma2Dec_DecodeToDic
Lzma2Dec_Init
Lzma2Dec_Parse
Lzma2Decode
LzmaDec_Allocate
LzmaDec_AllocateProbs
LzmaDec_DecodeToBuf
LzmaDec_DecodeToDic
LzmaDec_Free
LzmaDec_FreeProbs
LzmaDec_Init
LzmaDec_InitDicAndState
LzmaDecode
LzmaProps_Decode
MidAlloc
MidFree
MyAlloc
MyCPUID
MyFree
OutFile_Open
OutFile_OpenW
PPC_Convert
SHA256_K_ARRAY
SPARC_Convert
SecToLook_CreateVTable
SecToRead_CreateVTable
SeqInStream_Read
SeqInStream_Read2
SeqInStream_ReadByte
SetLargePageSize
Sha256Prepare
Sha256_Final
Sha256_Init
Sha256_InitState
Sha256_SetFunction
Sha256_Update
Sha256_UpdateBlocks
Sha256_UpdateBlocks_HW
XZ_SIG
XzBlock_Parse
XzBlock_ReadHeader
XzCheck_Final
XzCheck_Init
XzCheck_Update
XzCrc64UpdateT4
XzDecMtProps_Init
XzDecMt_Create
XzDecMt_Decode
XzDecMt_Destroy
XzFlags_GetCheckSize
XzStatInfo_Clear
XzUnpacker_Code
XzUnpacker_CodeFull
XzUnpacker_Construct
XzUnpacker_Free
XzUnpacker_GetExtraSize
XzUnpacker_Init
XzUnpacker_IsBlockFinished
XzUnpacker_IsStreamWasFinished
XzUnpacker_PrepareToRandomBlockDecoding
XzUnpacker_SetOutBuf
Xz_Construct
Xz_Free
Xz_GetPackSize
Xz_GetUnpackSize
Xz_ParseHeader
Xz_ReadHeader
Xz_ReadVarInt
Xz_WriteVarInt
Xzs_Construct
Xzs_Free
Xzs_GetNumBlocks
Xzs_GetUnpackSize
Xzs_ReadBackward
_dist_code
_length_code
_tr_align
_tr_flush_bits
_tr_flush_block
_tr_init
_tr_stored_block
_tr_tally
ab64_to_int
adler32
adler32_combine
adler32_combine64
adler32_z
base32_decode
base32_encode
base32_to_int
base64_decode
base64_encode
base64_to_int
base64url_to_int
bf64_to_int
byte_swap_16
byte_swap_32
byte_swap_64
call_zopen64
call_zseek64
call_ztell64
count_char
count_lines
crc32
crc32_combine
crc32_combine64
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
deflate_copyright
exec_hexify
exec_unhexify
extract_dynamicx_hash
fgetl
file_to_buffer
filename_from_filepath
fill_fopen64_filefunc
fill_fopen_filefunc
fill_zlib_filefunc64_32_def_from_filefunc32
g_AlignedAlloc
g_Alloc
g_BigAlloc
g_Crc64Table
g_CrcTable
g_CrcUpdate
g_CrcUpdateT0_32
g_CrcUpdateT0_64
g_CrcUpdateT4
g_CrcUpdateT8
g_MidAlloc
generic_salt_decode
generic_salt_encode
get_crc_table
get_entropy
get_random_num
gz_error
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
hc_asprintf
hc_bsearch_r
hc_fclose
hc_feof
hc_fflush
hc_fgetc
hc_fgets
hc_fopen
hc_fopen_raw
hc_fprintf
hc_fputc
hc_fread
hc_fscanf
hc_fseek
hc_fstat
hc_fsync
hc_ftell
hc_fwrite
hc_get_processor_count
hc_lzma1_decompress
hc_lzma2_decompress
hc_lzma_alloc
hc_lzma_free
hc_path_create
hc_path_exist
hc_path_has_bom
hc_path_is_directory
hc_path_is_empty
hc_path_is_fifo
hc_path_is_file
hc_path_read
hc_path_write
hc_qsort_r
hc_rewind
hc_same_files
hc_strchr_last
hc_strchr_next
hc_string_bom_size
hc_string_is_digit
hc_string_trim_leading
hc_string_trim_trailing
hc_strncat
hc_strtoul
hc_strtoull
hc_vfprintf
hccalloc
hcfree
hcfree_aligned
hcmalloc
hcmalloc_aligned
hcrealloc
hcstrdup
hex_convert
hex_decode
hex_encode
hex_to_u32
hex_to_u64
hex_to_u8
in_superchop
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
inflate_copyright
inflate_fast
inflate_table
input_tokenizer
int_to_ab64
int_to_base32
int_to_base64
int_to_base64url
int_to_bf64
int_to_itoa32
int_to_itoa64
int_to_lotus64
is_hexify
is_power_of_2
is_valid_base58_char
is_valid_base58_string
is_valid_base64a_char
is_valid_base64a_string
is_valid_base64b_char
is_valid_base64b_string
is_valid_base64c_char
is_valid_base64c_string
is_valid_bech32_char
is_valid_bech32_string
is_valid_digit_char
is_valid_digit_string
is_valid_float_char
is_valid_float_string
is_valid_hex_char
is_valid_hex_string
itoa32_to_int
itoa64_to_int
lotus64_to_int
lowercase
module_attack_exec
module_dgst_pos0
module_dgst_pos1
module_dgst_pos2
module_dgst_pos3
module_dgst_size
module_hash_category
module_hash_decode
module_hash_encode
module_hash_name
module_init
module_jit_build_options
module_kern_type
module_opti_type
module_opts_type
module_salt_type
module_st_hash
module_st_pass
mydivc32
mydivc64
naive_escape
naive_replace
need_hexify
overflow_check_u32_add
overflow_check_u32_mul
overflow_check_u64_add
overflow_check_u64_mul
power_of_two_ceil_32
power_of_two_floor_32
rotl32
rotl64
rotr32
rotr64
round_up_multiple_32
round_up_multiple_64
select_read_timeout
select_read_timeout_console
select_write_timeout
setup_environment_variables
setup_seeding
setup_umask
sort_by_string_sized
sort_by_stringptr
strhashcategory
stroptitype
strparser
superchop_with_length
u32_to_hex
u64_to_hex
u8_to_hex
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetCurrentFileInfo64
unzGetCurrentFileZStreamPos64
unzGetFilePos
unzGetFilePos64
unzGetGlobalComment
unzGetGlobalInfo
unzGetGlobalInfo64
unzGetLocalExtrafield
unzGetOffset
unzGetOffset64
unzGoToFilePos
unzGoToFilePos64
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpen2_64
unzOpen64
unzOpenCurrentFile
unzOpenCurrentFile2
unzOpenCurrentFile3
unzOpenCurrentFilePassword
unzReadCurrentFile
unzSetOffset
unzSetOffset64
unzStringFileNameCompare
unz_copyright
unzeof
unztell
unztell64
uppercase
v16a_from_v32
v16b_from_v32
v32_from_v16ab
v32a_from_v64
v32b_from_v64
v64_from_v32ab
v8a_from_v32
v8b_from_v32
v8c_from_v32
v8d_from_v32
x86_Convert
x86cpuid_CheckAndRead
x86cpuid_GetFirm
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

355293c917a80f86c1ec9d25889dfa7a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ws2_32

Exports

Exports

Sections

.text Size: 127KB - Virtual size: 126KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 22KB - Virtual size: 22KB

.pdata Size: 7KB - Virtual size: 6KB

.xdata Size: 5KB - Virtual size: 5KB

.bss Size: - Virtual size: 16KB

.edata Size: 11KB - Virtual size: 10KB

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 216B

.text
Size: 127KB - Virtual size: 126KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 22KB - Virtual size: 22KB

.pdata
Size: 7KB - Virtual size: 6KB

.xdata
Size: 5KB - Virtual size: 5KB

.bss
Size: - Virtual size: 16KB

.edata
Size: 11KB - Virtual size: 10KB

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 216B