180dee679c696a018f4916185611ad5e3bfc4bbd076e103edaeef71000cc5391

Sharing

Copy URL Twitter E-mail

General

Target

180dee679c696a018f4916185611ad5e3bfc4bbd076e103edaeef71000cc5391
Size

186KB
MD5

80b7969e8a6f9b511298c5fb71a525bd
SHA1

e2fa520ef245217fb8763a6753f91151e576dc88
SHA256

180dee679c696a018f4916185611ad5e3bfc4bbd076e103edaeef71000cc5391
SHA512

02eaf9bebc0633a2463b0e7ccaee1830fa7c781ef3a4b65f91af230ae90f17588f282e062c23c78fb2173024c2127b703fb547330a651d3e7292fe28f6121832
SSDEEP

3072:6vWxxbdVHlGRdHNtOIyZZzqko+EVrJiD2qwG+e9jyLEkQEsPy:4WxxJGRztDwzqGEV4D2qwLhsP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
180dee679c696a018f4916185611ad5e3bfc4bbd076e103edaeef71000cc5391

Files

180dee679c696a018f4916185611ad5e3bfc4bbd076e103edaeef71000cc5391
.dll windows:5 windows x86 arch:x86

719c5b4e26b09de83c2d909e8b51425b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
SetEndOfFile
GetTempPathA
GetTempFileNameA
DeleteFileA
GetLocalTime
GetTickCount
GetLastError
lstrcpyA
lstrcatA
OutputDebugStringA
LoadLibraryA
GetProcAddress
FreeLibrary
DecodePointer
EncodePointer
HeapAlloc
HeapFree
RaiseException
RtlUnwind
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleHandleW
ExitProcess
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetFilePointer
MultiByteToWideChar
ReadFile
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
Sleep
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileA
HeapReAlloc
LCMapStringW
GetStringTypeW
GetProcessHeap

user32

EndDialog
GetDlgItemTextA
DestroyWindow
DialogBoxParamA
wsprintfA

advapi32

CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptDestroyKey
CryptExportKey
CryptGetUserKey
CryptImportKey
CryptVerifySignatureA
CryptSetProvParam
CryptSignHashA
CryptGetKeyParam
CryptGetProvParam
CryptHashData

crypt32

CertEnumCertificatesInStore
CertOpenStore
CertDeleteCertificateFromStore
CertDuplicateCertificateContext

Exports

Exports

DeviceInitEx
XSCombinSignature
XSFatorySetting
XSGetCertsNumFromIE
XSKeyCalcHash
XSKeyCheckHash
XSKeyDelSealData
XSKeyGetCertDataXY
XSKeyGetCertType
XSKeyGetPublicKey
XSKeyGetSignature
XSKeyGetStatus
XSKeyInit
XSKeyIsExist
XSKeyLowFormat
XSKeyReadBioFlag
XSKeyReadCert
XSKeyReadCertAndType
XSKeyReadCspName
XSKeyReadErrorTimes
XSKeyReadFormatFlag
XSKeyReadHash
XSKeyReadInitFlag
XSKeyReadKeyBaseInfo
XSKeyReadKeyInfo
XSKeyReadLockFlag
XSKeyReadMode
XSKeyReadSealData
XSKeyReadSealNum
XSKeyReadSealTime
XSKeyReadSerial
XSKeyReadSerial_Encryption
XSKeyReadUnitId
XSKeyReadUserId
XSKeyReadVerison
XSKeyVerifyUserPin
XSKeyWriteBioFlag
XSKeyWriteErrorTimes
XSKeyWriteFormatFlag
XSKeyWriteHash
XSKeyWriteInitFlag
XSKeyWriteKeyBaseInfo
XSKeyWriteKeyFoxitData
XSKeyWriteKeyFoxitDataOfBeiJing
XSKeyWriteKeyInfo
XSKeyWriteLastTime
XSKeyWriteLockFlag
XSKeyWriteMode
XSKeyWriteSealData
XSKeyWriteSealTime
XSKeyWriteStartTime
XSKeyWriteUnitId
XSKeyWriteUserId
XSParseSignautre
XSReadLastTime
XSReadStartTime
XSReadTimeControl
XSRegCerts
XSRemoveAllCertsFromIE
XSSetStartAndLastTime
XSShowDlg
XSSignMessage
XSVerifyMessage
XSVerifySealTime
XSVerifySign
XSWriteTimeControl

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

719c5b4e26b09de83c2d909e8b51425b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

crypt32

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 18KB