303c9363a2df1110a9b1aa9be4f7ab964795dd92a00edfe35da343ea20f40bea

Sharing

Copy URL Twitter E-mail

General

Target

303c9363a2df1110a9b1aa9be4f7ab964795dd92a00edfe35da343ea20f40bea
Size

1.2MB
MD5

4e8aa3dd79653b753f23635571d713c7
SHA1

37e7588f90d2a0b171dfbdd5d980d789ae50b2a9
SHA256

303c9363a2df1110a9b1aa9be4f7ab964795dd92a00edfe35da343ea20f40bea
SHA512

ab4e93da47796899f63faf0c29f3a7af50a4ef5e12bf8ba20a8ff6b0ccbeb9ee2a7988c651695342520cac1a489395f5f3bc94e2c79ad7d56fa358537a5ab86a
SSDEEP

24576:W7HgUcuamX6zfEyFSgEVgkyPty4L0utf2+sLS8RZceywgn9NCS9KYrYSkuAgTuBP:W7HgUcuxX6zfEyFhEVgkyPty4L0ut5sL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
303c9363a2df1110a9b1aa9be4f7ab964795dd92a00edfe35da343ea20f40bea

Files

303c9363a2df1110a9b1aa9be4f7ab964795dd92a00edfe35da343ea20f40bea
.dll windows:6 windows x86 arch:x86

6135cd5423c67b53c29224b718bf3b81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\ProgramData\wxext.cn.pdb

Imports

kernel32

InitializeCriticalSectionEx
HeapSize
GetLastError
SetEvent
LockResource
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
FreeLibraryAndExitThread
Sleep
CloseHandle
CreateThread
IsDebuggerPresent
DuplicateHandle
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetModuleFileNameW
WaitForSingleObject
CreateEventW
GlobalAlloc
GlobalFree
GlobalLock
ReadProcessMemory
GlobalUnlock
VirtualProtect
GetCurrentProcess
VirtualProtectEx
GetCurrentProcessId
ReadFile
CreatePipe
PeekNamedPipe
CreateProcessA
SetWaitableTimer
TlsSetValue
SetLastError
EnterCriticalSection
CreateWaitableTimerW
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
GetModuleHandleA
PostQueuedCompletionStatus
FormatMessageW
TerminateThread
TlsAlloc
QueueUserAPC
LocalFree
VerSetConditionMask
SleepEx
VerifyVersionInfoW
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
OpenEventA
CreateEventA
SetEndOfFile
WriteConsoleW
CreateFileW
HeapFree
WriteProcessMemory
LoadLibraryW
SizeofResource
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetTimeZoneInformation
SetFilePointerEx
GetFileSizeEx
DeleteFileW
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitThread
CreateDirectoryW
GetFileAttributesExW
GetModuleHandleExW
ExitProcess
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
FreeLibrary
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
SwitchToThread
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation

user32

EnumWindows
GetClassNameA
GetWindowThreadProcessId
PostMessageW

shell32

SHGetSpecialFolderPathA

libcrypto-1_1

RSA_size
BIO_free
PEM_read_bio_RSA_PUBKEY
RSA_free
RSA_public_decrypt
BIO_new_mem_buf

shlwapi

PathAddBackslashA

urlmon

URLDownloadToFileW

winhttp

WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

listen
WSASetLastError
WSASocketW
htons
WSAGetLastError
setsockopt
ioctlsocket
freeaddrinfo
htonl
getsockopt
WSARecv
WSAAddressToStringW
connect
ntohs
getsockname
getpeername
WSAStartup
shutdown
ntohl
select
WSASend
closesocket
WSAIoctl
bind
accept
__WSAFDIsSet
WSACleanup
getaddrinfo

Sections

.text
Size: 947KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6135cd5423c67b53c29224b718bf3b81

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

libcrypto-1_1

shlwapi

urlmon

winhttp

version

ws2_32

Sections

.text Size: 947KB - Virtual size: 947KB

.rdata Size: 170KB - Virtual size: 169KB

.data Size: 30KB - Virtual size: 35KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 45KB - Virtual size: 45KB

.text
Size: 947KB - Virtual size: 947KB

.rdata
Size: 170KB - Virtual size: 169KB

.data
Size: 30KB - Virtual size: 35KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 45KB - Virtual size: 45KB