ee90cc0db538ae50ac5e4cb24b8e3ae3cc9b2c98c5c4900604e88568af200204

Sharing

Copy URL Twitter E-mail

General

Target

ee90cc0db538ae50ac5e4cb24b8e3ae3cc9b2c98c5c4900604e88568af200204
Size

430KB
MD5

367b6adcb0f967e06eb4324c3bd59c49
SHA1

287afd0b877683ccaf7969d5e7f52d3bee66a806
SHA256

ee90cc0db538ae50ac5e4cb24b8e3ae3cc9b2c98c5c4900604e88568af200204
SHA512

62d5a9c69273cbdceb9e3f8c2a6590e67e9c580052ba3dbc6b98a52f54ad06166f0d80eb321b27612bbd8a66dafd0dcf9312d93a9ffb51ef34e2eaaf712f59f2
SSDEEP

3072:D4Sl9haxQufGsEPEpvJYeg+zOJhUQlaso9MW7KwQAzkZhS/xJ4sOU9RViiI7RcDH:k29QGu1EPpet7oWP4Quk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee90cc0db538ae50ac5e4cb24b8e3ae3cc9b2c98c5c4900604e88568af200204

Files

ee90cc0db538ae50ac5e4cb24b8e3ae3cc9b2c98c5c4900604e88568af200204
.dll windows:4 windows x86 arch:x86

dac8e3200b1cc0d693c22a2b59a942c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHDeleteKeyA

kernel32

TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalLock
GlobalReAlloc
GlobalAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
lstrcatA
lstrcpyA
GetModuleFileNameA
lstrcpynA
GetVersion
SetLastError
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
InitializeCriticalSection
lstrcmpA
GlobalFlags
GetCPInfo
GetOEMCP
CreateFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
RtlUnwind
GetCommandLineA
HeapFree
HeapAlloc
RaiseException
HeapSize
HeapReAlloc
ExitProcess
TerminateProcess
GetACP
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
GetStringTypeA
GetStringTypeW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
GetCurrentThreadId
MultiByteToWideChar
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetVersionExA
GetCurrentThread
CloseHandle
GetLastError
LocalAlloc
LocalFree
MoveFileExA
FindNextFileA
SetFileAttributesA
GetSystemWindowsDirectoryA
WideCharToMultiByte
FindFirstFileA
FindClose
GetModuleHandleA
GetCurrentProcess
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
CopyFileA
DeleteFileA
GetProcAddress
FreeLibrary
LoadLibraryA
GetProcessVersion

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

user32

GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
EnableWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
IsWindowEnabled
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
UnregisterClassA
DispatchMessageA
SendMessageA
GetKeyState
CallNextHookEx
PeekMessageA
SetWindowsHookExA
MessageBoxA
GetForegroundWindow
SendMessageTimeoutA
LoadStringW
LoadStringA
UnhookWindowsHookEx

advapi32

CloseServiceHandle
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
LookupPrivilegeValueA
LookupPrivilegeNameA
RegQueryValueExA
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
OpenSCManagerA
OpenServiceA
ChangeServiceConfigA

msi

ord160
ord138
ord163
ord124
ord49
ord8
ord31
ord159
ord144
ord117
ord120
ord57
ord73

wsock32

gethostname
WSAStartup
WSACleanup

comctl32

ord17

gdi32

GetClipBox
SetTextColor
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetBkColor
GetObjectA
GetDeviceCaps
DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectObject
GetStockObject
CreateBitmap
SetMapMode

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

Exports

Exports

caOMILAutry3xNodeUpgradeStage1
caOMILAutry3xNodeUpgradeStage2
caOMILAutry3xStationUpgradeStage1
caOMILAutry3xStationUpgradeStage2
caOMILCTCheck
caOMILCheckTEMP
caOMILFinalize
caOMILFixITADependServiceRegKey
caOMILFixStorageDependServiceRegKey
caOMILGetITACustomProperties
caOMILHideCancelButton
caOMILInstallPNPDrivers
caOMILOldNodeCheck
caOMILOldStationCheck
caOMILPostInstall
caOMILPostInstallMsg
caOMILPostInstallRollback
caOMILPreInstall
caOMILPreInstallRollback
caOMILPreReqCheckNode
caOMILPreReqCheckStation
caOMILResetDisallowedFeatures
caOMILSetFirstTimeInstall
caOMILSetITACustomProperties
caOMILSetSummaryText
caOMILSystemCheck
caOMILTestINSTALLDIR
caOMILVerifyFeatureInstallAction
caOMILVerifyITACustomDialogInput
caOMILWriteInfo

Sections

.text
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dac8e3200b1cc0d693c22a2b59a942c9

Headers

File Characteristics

Imports

shlwapi

kernel32

version

user32

advapi32

msi

wsock32

comctl32

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 122KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 28KB - Virtual size: 40KB

.rsrc Size: 56KB - Virtual size: 55KB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 124KB - Virtual size: 122KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 28KB - Virtual size: 40KB

.rsrc
Size: 56KB - Virtual size: 55KB

.reloc
Size: 16KB - Virtual size: 14KB