3e55b8f83888876023896576cc5849a86a0e5d9828df89e93de2d6e7e0e037e9

Sharing

Copy URL Twitter E-mail

General

Target

3e55b8f83888876023896576cc5849a86a0e5d9828df89e93de2d6e7e0e037e9
Size

154KB
MD5

fb440753675363fa570a94c2f907034f
SHA1

c5402c0223e9883b9dbe6432f484784c20683c51
SHA256

3e55b8f83888876023896576cc5849a86a0e5d9828df89e93de2d6e7e0e037e9
SHA512

28f43db1ee5acacec92bdb8cb048fc909169e7ff4207e70dad9e674b6cf7ccaa8717cfe47442fc48286c8351c02ba094b70b9ed69f419a20bab83f35ef59857e
SSDEEP

3072:VUlkXjDlAZ9s1GOSPZhegBka+zfkUlm58nIJnJlrotSIMX2aDgsL0GZa:XlAQmPZIgeBfXW8ax0GZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e55b8f83888876023896576cc5849a86a0e5d9828df89e93de2d6e7e0e037e9

Files

3e55b8f83888876023896576cc5849a86a0e5d9828df89e93de2d6e7e0e037e9
.dll windows:6 windows x64 arch:x64

bb1af4e72f3febeea3c9df6f82042a0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

CreateRestrictedToken
OpenProcessToken
ConvertSidToStringSidA
IsTextUnicode
CreateProcessAsUserW

ntdll

RtlFreeUnicodeString
RtlStringFromGUID
RtlEqualString

rpcrt4

MesHandleFree
MesDecodeIncrementalHandleCreate
NdrMesTypeFree2
NdrMesTypeDecode2
MesIncrementalHandleReset

ole32

CoCreateInstance

kernel32

WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
ReadConsoleW
ReadFile
SetFilePointerEx
GetStringTypeW
CreateFileW
SetStdHandle
GetCurrentProcess
CloseHandle
lstrlenW
LoadLibraryW
GetProcAddress
FreeLibrary
VirtualProtect
GetLastError
LocalAlloc
LocalFree
GetTimeFormatA
FileTimeToSystemTime
GetDateFormatA
FileTimeToLocalFileTime
RaiseException
GetSystemInfo
VirtualQuery
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetProcessHeap
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW

Exports

Exports

DhcpNewPktHook
DhcpServerCalloutEntry
DllCanUnloadNow
DllGetClassObject
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
NPGetCaps
NPLogonNotify
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
startW
zzzkatz

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb1af4e72f3febeea3c9df6f82042a0e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ntdll

rpcrt4

ole32

kernel32

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 45KB - Virtual size: 44KB

.data Size: 7KB - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 7KB - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB