43dde38ad26b5169400b995ead91e8f1bc0370d29088672ce6dcac25c6c17329

Sharing

Copy URL Twitter E-mail

General

Target

43dde38ad26b5169400b995ead91e8f1bc0370d29088672ce6dcac25c6c17329
Size

1.2MB
MD5

8528d6459b968d7655d35a7231a1d4e2
SHA1

d2c2efbfa7a6b1c39a321db862ed0909c5e7f1d4
SHA256

43dde38ad26b5169400b995ead91e8f1bc0370d29088672ce6dcac25c6c17329
SHA512

be4a8a49fcffb6d827ff6047acdd9eac8afd6f0232dfeb32a5b00293b350678ce545cabf828911add63a34e494078297249163d8865dc1307e45e175b54c9ce6
SSDEEP

3072:j8/ob+TLI3apUQqSb3+6SiQ/wi9M4lzN3RbSMd7eoR/YCmo5Vihp4X8IuXBJSycF:j8JTLLpUQR3HW/A49joedihp4ISBG87

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43dde38ad26b5169400b995ead91e8f1bc0370d29088672ce6dcac25c6c17329

Files

43dde38ad26b5169400b995ead91e8f1bc0370d29088672ce6dcac25c6c17329
.dll windows:10 windows x86 arch:x86

ce8f2a8007cb8feb477d74baf3114913

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

olecli32.pdb

Imports

msvcrt

_XcptFilter
__dllonexit
_onexit
memmove
_vsnwprintf
memcmp
memcpy
wcsncmp
_errno
_purecall
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
??3@YAXPAX@Z
memset

kernel32

VirtualQuery
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
IsDebuggerPresent
IsWow64Process
DebugBreak
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitOnceComplete
GetCurrentThread
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleHandleExW
ReleaseSemaphore
OutputDebugStringA
SetLastError
HeapFree
CreateSemaphoreExW
InitOnceBeginInitialize
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
OpenFile
CompareStringA
GetCurrentThreadId
GetDriveTypeA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcmpiA
lstrcmpA
LocalHandle
GlobalReAlloc
LocalUnlock
GlobalFindAtomA
WinExec
LocalFree
GlobalSize
GlobalAddAtomA
GlobalDeleteAtom
LocalAlloc
LocalLock
GlobalGetAtomNameA
EnterCriticalSection
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
MulDiv

advapi32

SetThreadToken
RegOpenKeyExA
EventUnregister
OpenThreadToken
OpenProcessToken
RegOpenUserClassesRoot
EventSetInformation
EventRegister
RegQueryValueExA
EventWriteTransfer
RegCloseKey

user32

IsClipboardFormatAvailable
CharUpperBuffA
PeekMessageA
IsWindow
GetClipboardFormatNameA
RegisterClipboardFormatA
FreeDDElParam
GetWindowThreadProcessId
UnregisterClassA
RegisterClassA
EnumClipboardFormats
CloseClipboard
ReleaseDC
SetClipboardData
GetClipboardData
GetDC
UnpackDDElParam
PackDDElParam
KillTimer
SendMessageA
CreateWindowExA
DefWindowProcA
GetWindowLongA
SetWindowLongA
SetTimer
PostMessageA
GetDlgItem
OpenClipboard
DestroyWindow
RemovePropA
SetPropA
IsWindowVisible
LoadStringA
EndDialog
DialogBoxParamA
GetDlgItemTextA
MessageBoxA
GetPropA
SendDlgItemMessageA
SetDlgItemTextA
EnumThreadWindows

gdi32

GetMetaFileBitsEx
SetMetaFileBitsEx
CloseMetaFile
CreateMetaFileA
CopyMetaFileA
DeleteMetaFile
EnumEnhMetaFile
SelectObject
GetWindowExtEx
CreateCompatibleDC
StretchBlt
RealizePalette
StretchDIBits
SetWindowOrgEx
GetStockObject
PlayMetaFileRecord
SetWindowExtEx
GetDIBits
PlayEnhMetaFileRecord
SetViewportExtEx
DeleteDC
SelectPalette
SetViewportOrgEx
CreatePalette
EnumMetaFile
RestoreDC
LPtoDP
SetMapMode
IntersectClipRect
SetWinMetaFileBits
SaveDC
GetBitmapDimensionEx
GetBitmapBits
SetBitmapDimensionEx
GetDeviceCaps
SetBitmapBits
DeleteObject
CreateBitmap
GetObjectA
CopyEnhMetaFileA
SetEnhMetaFileBits
GetEnhMetaFileHeader
GetWinMetaFileBits
DeleteEnhMetaFile
GetEnhMetaFileBits
GetViewportExtEx

mpr

WNetGetConnectionA
WNetAddConnectionA

ntdll

EtwTraceMessage

Exports

Exports

BmChangeData
BmClone
BmCopy
BmDraw
BmEnumFormat
BmEqual
BmGetData
BmQueryBounds
BmRelease
BmSaveToStream
CheckNetDrive
ConnectDlgProc
DefCreate
DefCreateFromClip
DefCreateFromFile
DefCreateFromTemplate
DefCreateInvisible
DefCreateLinkFromClip
DefCreateLinkFromFile
DefLoadFromStream
DibChangeData
DibClone
DibCopy
DibDraw
DibEnumFormat
DibEqual
DibGetData
DibQueryBounds
DibRelease
DibSaveToStream
DocWndProc
ErrActivate
ErrClose
ErrCopyFromLink
ErrExecute
ErrGetUpdateOptions
ErrObjectConvert
ErrObjectLong
ErrQueryOpen
ErrQueryOutOfDate
ErrQueryProtocol
ErrReconnect
ErrSetBounds
ErrSetData
ErrSetHostNames
ErrSetTargetDevice
ErrSetUpdateOptions
ErrShow
ErrUpdate
GenChangeData
GenClone
GenCopy
GenDraw
GenEnumFormat
GenEqual
GenGetData
GenQueryBounds
GenRelease
GenSaveToStream
GenSetData
GetTaskVisibleWindow
LeActivate
LeChangeData
LeClone
LeClose
LeCopy
LeCopyFromLink
LeCreateInvisible
LeDraw
LeEnumFormat
LeEqual
LeExecute
LeGetData
LeGetUpdateOptions
LeObjectConvert
LeObjectLong
LeQueryBounds
LeQueryOpen
LeQueryOutOfDate
LeQueryProtocol
LeQueryType
LeReconnect
LeRelease
LeSaveToStream
LeSetBounds
LeSetData
LeSetHostNames
LeSetTargetDevice
LeSetUpdateOptions
LeShow
LeUpdate
MfCallbackFunc
MfChangeData
MfClone
MfCopy
MfDraw
MfEnumFormat
MfEqual
MfGetData
MfQueryBounds
MfRelease
MfSaveToStream
ObjQueryName
ObjQuerySize
ObjQueryType
ObjRename
OleActivate
OleClone
OleClose
OleCopyFromLink
OleCopyToClipboard
OleCreate
OleCreateFromClip
OleCreateFromFile
OleCreateFromTemplate
OleCreateInvisible
OleCreateLinkFromClip
OleCreateLinkFromFile
OleDelete
OleDraw
OleEnumFormats
OleEnumObjects
OleEqual
OleExecute
OleGetData
OleGetLinkUpdateOptions
OleIsDcMeta
OleLoadFromStream
OleLockServer
OleObjectConvert
OleQueryBounds
OleQueryClientVersion
OleQueryCreateFromClip
OleQueryLinkFromClip
OleQueryName
OleQueryOpen
OleQueryOutOfDate
OleQueryProtocol
OleQueryReleaseError
OleQueryReleaseMethod
OleQueryReleaseStatus
OleQuerySize
OleQueryType
OleReconnect
OleRegisterClientDoc
OleRelease
OleRename
OleRenameClientDoc
OleRequestData
OleRevertClientDoc
OleRevokeClientDoc
OleSaveToStream
OleSavedClientDoc
OleSetBounds
OleSetColorScheme
OleSetData
OleSetHostNames
OleSetLinkUpdateOptions
OleSetTargetDevice
OleUnlockServer
OleUpdate
PbCopyToClipboard
PbCreate
PbCreateFromClip
PbCreateFromFile
PbCreateFromTemplate
PbCreateInvisible
PbCreateLinkFromClip
PbCreateLinkFromFile
PbDraw
PbEnumFormats
PbGetData
PbLoadFromStream
PbQueryBounds
SetNetName
SetNextNetDrive
SrvrWndProc
WEP

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce8f2a8007cb8feb477d74baf3114913

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

user32

gdi32

mpr

ntdll

Exports

Exports

Sections

.text Size: 90KB - Virtual size: 90KB

.data Size: 1KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 149KB - Virtual size: 148KB

.text
Size: 90KB - Virtual size: 90KB

.data
Size: 1KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 149KB - Virtual size: 148KB