ffcabbf0afb48cf40d38443cea06b07028699d1e7b17a523bc46695f0574f9b1

Sharing

Copy URL Twitter E-mail

General

Target

ffcabbf0afb48cf40d38443cea06b07028699d1e7b17a523bc46695f0574f9b1
Size

245KB
MD5

4d863837135db2e13f22475ab38fad26
SHA1

113df4619b6948fa0d58d0412a0bf5594255995d
SHA256

ffcabbf0afb48cf40d38443cea06b07028699d1e7b17a523bc46695f0574f9b1
SHA512

007c9526b06a62cdf29aad30544ba8011d1e71ed007eeb1b435dc6355c7693ff58c4754b218227547e850bbf79bf23f24907090d63af906734f5aceaed61e128
SSDEEP

3072:y8/obcTi+3BpUNq3F03+6fir/wi9M4lONSLRbSwft9TJjYCmo1fihpqxDISXBJmd:y8nTiupUN403H6/A42or13ihpqzm1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffcabbf0afb48cf40d38443cea06b07028699d1e7b17a523bc46695f0574f9b1

Files

ffcabbf0afb48cf40d38443cea06b07028699d1e7b17a523bc46695f0574f9b1
.dll windows:10 windows x86 arch:x86

ce8f2a8007cb8feb477d74baf3114913

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

olecli32.pdb

Imports

msvcrt

_XcptFilter
__dllonexit
_onexit
memmove
_vsnwprintf
memcmp
memcpy
wcsncmp
_errno
_purecall
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
??3@YAXPAX@Z
memset

kernel32

VirtualQuery
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
IsDebuggerPresent
IsWow64Process
DebugBreak
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitOnceComplete
GetCurrentThread
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleHandleExW
ReleaseSemaphore
OutputDebugStringA
SetLastError
HeapFree
CreateSemaphoreExW
InitOnceBeginInitialize
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
OpenFile
CompareStringA
GetCurrentThreadId
GetDriveTypeA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcmpiA
lstrcmpA
LocalHandle
GlobalReAlloc
LocalUnlock
GlobalFindAtomA
WinExec
LocalFree
GlobalSize
GlobalAddAtomA
GlobalDeleteAtom
LocalAlloc
LocalLock
GlobalGetAtomNameA
EnterCriticalSection
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
MulDiv

advapi32

SetThreadToken
RegOpenKeyExA
EventUnregister
OpenThreadToken
OpenProcessToken
RegOpenUserClassesRoot
EventSetInformation
EventRegister
RegQueryValueExA
EventWriteTransfer
RegCloseKey

user32

IsClipboardFormatAvailable
CharUpperBuffA
PeekMessageA
IsWindow
GetClipboardFormatNameA
RegisterClipboardFormatA
FreeDDElParam
GetWindowThreadProcessId
UnregisterClassA
RegisterClassA
EnumClipboardFormats
CloseClipboard
ReleaseDC
SetClipboardData
GetClipboardData
GetDC
UnpackDDElParam
PackDDElParam
KillTimer
SendMessageA
CreateWindowExA
DefWindowProcA
GetWindowLongA
SetWindowLongA
SetTimer
PostMessageA
GetDlgItem
OpenClipboard
DestroyWindow
RemovePropA
SetPropA
IsWindowVisible
LoadStringA
EndDialog
DialogBoxParamA
GetDlgItemTextA
MessageBoxA
GetPropA
SendDlgItemMessageA
SetDlgItemTextA
EnumThreadWindows

gdi32

GetMetaFileBitsEx
SetMetaFileBitsEx
CloseMetaFile
CreateMetaFileA
CopyMetaFileA
DeleteMetaFile
EnumEnhMetaFile
SelectObject
GetWindowExtEx
CreateCompatibleDC
StretchBlt
RealizePalette
StretchDIBits
SetWindowOrgEx
GetStockObject
PlayMetaFileRecord
SetWindowExtEx
GetDIBits
PlayEnhMetaFileRecord
SetViewportExtEx
DeleteDC
SelectPalette
SetViewportOrgEx
CreatePalette
EnumMetaFile
RestoreDC
LPtoDP
SetMapMode
IntersectClipRect
SetWinMetaFileBits
SaveDC
GetBitmapDimensionEx
GetBitmapBits
SetBitmapDimensionEx
GetDeviceCaps
SetBitmapBits
DeleteObject
CreateBitmap
GetObjectA
CopyEnhMetaFileA
SetEnhMetaFileBits
GetEnhMetaFileHeader
GetWinMetaFileBits
DeleteEnhMetaFile
GetEnhMetaFileBits
GetViewportExtEx

mpr

WNetGetConnectionA
WNetAddConnectionA

ntdll

EtwTraceMessage

Exports

Exports

BmChangeData
BmClone
BmCopy
BmDraw
BmEnumFormat
BmEqual
BmGetData
BmQueryBounds
BmRelease
BmSaveToStream
CheckNetDrive
ConnectDlgProc
DefCreate
DefCreateFromClip
DefCreateFromFile
DefCreateFromTemplate
DefCreateInvisible
DefCreateLinkFromClip
DefCreateLinkFromFile
DefLoadFromStream
DibChangeData
DibClone
DibCopy
DibDraw
DibEnumFormat
DibEqual
DibGetData
DibQueryBounds
DibRelease
DibSaveToStream
DocWndProc
ErrActivate
ErrClose
ErrCopyFromLink
ErrExecute
ErrGetUpdateOptions
ErrObjectConvert
ErrObjectLong
ErrQueryOpen
ErrQueryOutOfDate
ErrQueryProtocol
ErrReconnect
ErrSetBounds
ErrSetData
ErrSetHostNames
ErrSetTargetDevice
ErrSetUpdateOptions
ErrShow
ErrUpdate
GenChangeData
GenClone
GenCopy
GenDraw
GenEnumFormat
GenEqual
GenGetData
GenQueryBounds
GenRelease
GenSaveToStream
GenSetData
GetTaskVisibleWindow
LeActivate
LeChangeData
LeClone
LeClose
LeCopy
LeCopyFromLink
LeCreateInvisible
LeDraw
LeEnumFormat
LeEqual
LeExecute
LeGetData
LeGetUpdateOptions
LeObjectConvert
LeObjectLong
LeQueryBounds
LeQueryOpen
LeQueryOutOfDate
LeQueryProtocol
LeQueryType
LeReconnect
LeRelease
LeSaveToStream
LeSetBounds
LeSetData
LeSetHostNames
LeSetTargetDevice
LeSetUpdateOptions
LeShow
LeUpdate
MfCallbackFunc
MfChangeData
MfClone
MfCopy
MfDraw
MfEnumFormat
MfEqual
MfGetData
MfQueryBounds
MfRelease
MfSaveToStream
ObjQueryName
ObjQuerySize
ObjQueryType
ObjRename
OleActivate
OleClone
OleClose
OleCopyFromLink
OleCopyToClipboard
OleCreate
OleCreateFromClip
OleCreateFromFile
OleCreateFromTemplate
OleCreateInvisible
OleCreateLinkFromClip
OleCreateLinkFromFile
OleDelete
OleDraw
OleEnumFormats
OleEnumObjects
OleEqual
OleExecute
OleGetData
OleGetLinkUpdateOptions
OleIsDcMeta
OleLoadFromStream
OleLockServer
OleObjectConvert
OleQueryBounds
OleQueryClientVersion
OleQueryCreateFromClip
OleQueryLinkFromClip
OleQueryName
OleQueryOpen
OleQueryOutOfDate
OleQueryProtocol
OleQueryReleaseError
OleQueryReleaseMethod
OleQueryReleaseStatus
OleQuerySize
OleQueryType
OleReconnect
OleRegisterClientDoc
OleRelease
OleRename
OleRenameClientDoc
OleRequestData
OleRevertClientDoc
OleRevokeClientDoc
OleSaveToStream
OleSavedClientDoc
OleSetBounds
OleSetColorScheme
OleSetData
OleSetHostNames
OleSetLinkUpdateOptions
OleSetTargetDevice
OleUnlockServer
OleUpdate
PbCopyToClipboard
PbCreate
PbCreateFromClip
PbCreateFromFile
PbCreateFromTemplate
PbCreateInvisible
PbCreateLinkFromClip
PbCreateLinkFromFile
PbDraw
PbEnumFormats
PbGetData
PbLoadFromStream
PbQueryBounds
SetNetName
SetNextNetDrive
SrvrWndProc
WEP

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce8f2a8007cb8feb477d74baf3114913

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

user32

gdi32

mpr

ntdll

Exports

Exports

Sections

.text Size: 90KB - Virtual size: 90KB

.data Size: 1KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 145KB - Virtual size: 144KB

.text
Size: 90KB - Virtual size: 90KB

.data
Size: 1KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 145KB - Virtual size: 144KB