240a801b5d098d6736c914c3eefabed40deedae0e255eaf12f4a7b3967c4a86e

Sharing

Copy URL Twitter E-mail

General

Target

240a801b5d098d6736c914c3eefabed40deedae0e255eaf12f4a7b3967c4a86e
Size

1.1MB
MD5

1b22e0ece8bbc18c57b7f16484b3405b
SHA1

972a33b500a8d23cac063e20b5990bf3ad5a9150
SHA256

240a801b5d098d6736c914c3eefabed40deedae0e255eaf12f4a7b3967c4a86e
SHA512

a1b9d59b115957af7cad15916223a759574929f317f17b5297aa94655daa96b796454f3c664b0897c0c710cb5aba4980f1914bb5762f1fe74d39e1a507b32039
SSDEEP

24576:REwWpVIlWrObwnLwmLHgZuJ8t09QB33jyq6IsTEEZ:REXrOkLwmLHLJ8Lv8T1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
240a801b5d098d6736c914c3eefabed40deedae0e255eaf12f4a7b3967c4a86e

Files

240a801b5d098d6736c914c3eefabed40deedae0e255eaf12f4a7b3967c4a86e
.dll windows:6 windows x86 arch:x86

df744b1cb2105de385ec066d19204503

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\setupexe\x-none\setupbootstrapper.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust

advapi32

ConvertSidToStringSidA
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExW
OpenProcessToken
AllocateAndInitializeSid
CreateWellKnownSid
EqualSid
FreeSid
GetTokenInformation
IsValidSid
OpenThreadToken
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
EventRegister
EventUnregister
EventWrite
RegQueryInfoKeyW
RegGetValueW
RegEnumKeyW
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetLengthSid
CopySid
CheckTokenMembership
AddAccessDeniedAce
AddAccessAllowedAce
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

CopyFileW
SetLastError
WaitForSingleObjectEx
GetCommandLineW
SetCurrentDirectoryW
GlobalFree
GetCurrentThreadId
GetFullPathNameW
GetSystemDirectoryW
MultiByteToWideChar
VerSetConditionMask
WriteFile
VerifyVersionInfoW
GetUserDefaultLCID
GetDiskFreeSpaceExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalAlloc
LocalAlloc
LocalFree
SetFilePointerEx
GetFileType
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetTickCount
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
RaiseFailFastException
GetFileSize
GlobalMemoryStatusEx
GetNativeSystemInfo
GetProductInfo
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLCID
TerminateProcess
LCIDToLocaleName
CreateMutexA
OpenMutexA
ReadFile
GetACP
IsValidLocale
RaiseException
RtlCaptureStackBackTrace
HeapAlloc
HeapFree
GetProcessHeap
DecodePointer
GetCommandLineA
EncodePointer
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCPInfo
GetOEMCP
IsValidCodePage
GetStringTypeW
LCMapStringW
InterlockedExchange
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
lstrcmpW
InitializeCriticalSection
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
GetCurrentThread
GetCurrentProcessId
CloseHandle
ExpandEnvironmentStringsW
WideCharToMultiByte
FormatMessageW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetVersionExW
SetErrorMode
FindFirstFileExW
FindClose
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CreateFileW
LoadLibraryA
LoadResource
SizeofResource
FindResourceW
GetShortPathNameA
LocaleNameToLCID
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
CompareStringW

ole32

CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

gdi32

DeleteObject
CreateSolidBrush
DeleteDC
GetDeviceCaps
CreateDCA

Exports

Exports

WinMain

Sections

.text
Size: 409KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df744b1cb2105de385ec066d19204503

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

wintrust

advapi32

kernel32

ole32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 409KB - Virtual size: 408KB

.data Size: 212KB - Virtual size: 242KB

.rsrc Size: 164KB - Virtual size: 163KB

.reloc Size: 300KB - Virtual size: 300KB

.text
Size: 409KB - Virtual size: 408KB

.data
Size: 212KB - Virtual size: 242KB

.rsrc
Size: 164KB - Virtual size: 163KB

.reloc
Size: 300KB - Virtual size: 300KB