97da5d146a47bb9590998696ab79aec4096159db828bcdc6954d4d7a0cccbc4f

Sharing

Copy URL Twitter E-mail

General

Target

97da5d146a47bb9590998696ab79aec4096159db828bcdc6954d4d7a0cccbc4f
Size

982KB
MD5

c90d52e9abe626c3d640652c650d1a63
SHA1

6bcbc5335ce7a5cd8c0e09e6681986d9623e3a93
SHA256

97da5d146a47bb9590998696ab79aec4096159db828bcdc6954d4d7a0cccbc4f
SHA512

526e9c992c639249c63008676f471826db30d5fa85167107abc712550fb4bc4c407aaf9afa176b2a9cc48909b516fb6728b88ef78ff94b786ca8405d0a89486a
SSDEEP

24576:KIyrKn+U7cEx1zr7Kwmd7jMFa+dvMPd6:I0T71v7Kw0jsa+dvud6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97da5d146a47bb9590998696ab79aec4096159db828bcdc6954d4d7a0cccbc4f

Files

97da5d146a47bb9590998696ab79aec4096159db828bcdc6954d4d7a0cccbc4f
.dll regsvr32 windows:6 windows x86 arch:x86

5fd60c97bd30fd3751864514c38ddf84

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\jenkins\workspace\msi-sensor-x64-release-build\activeprobe\Powereason\x86\Release\Powereason.pdb

Imports

wsock32

accept
bind
closesocket
connect
sendto
recvfrom
inet_addr
ioctlsocket
ntohl
ntohs
getpeername
WSACleanup
WSAStartup
setsockopt
send
recv
listen
htons
htonl
getsockopt
getsockname
inet_ntoa
WSAGetLastError

kernel32

GetVersionExW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
ExitThread
GetCommandLineA
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
GetSystemDirectoryW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
Sleep
FormatMessageA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
FreeLibrary
VirtualAlloc
SetHandleInformation
IsDebuggerPresent
CloseHandle
WaitForSingleObject
GetCurrentThreadId
TryEnterCriticalSection
GetHandleInformation
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatusEx
CancelIoEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
GetTickCount64
GetModuleHandleW
SetFileCompletionNotificationModes
WideCharToMultiByte
SetStdHandle
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
WriteConsoleW
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetFilePointerEx
GetFileSizeEx
HeapSize
SignalObjectAndWait
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
CreateTimerQueue
LoadLibraryA
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
RemoveDirectoryW
SetThreadPriority
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
GetStringTypeW
EncodePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetTempPathW
CreateThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetCurrentThread
HeapFree
HeapAlloc
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetFileAttributesExW
CreateFileW
DeleteFileW
CreateDirectoryW

advapi32

SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExA
CryptGenRandom
CryptAcquireContextA
RegCloseKey
InitializeSecurityDescriptor
RegSetValueExW
RegCreateKeyExW

ole32

StringFromIID
CoGetMalloc

oleaut32

SafeArrayAccessData
GetErrorInfo
SysAllocString
SysFreeString
SafeArrayCreate
VariantClear
VariantInit
SafeArrayUnaccessData
SafeArrayDestroy

shlwapi

SHDeleteKeyW

iphlpapi

if_indextoname
GetAdaptersAddresses

ws2_32

WSASocketA
getnameinfo
WSAIoctl
getaddrinfo
freeaddrinfo
WSAPoll

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NativeBridge0
NativeBridge1
NativeBridge2
NativeBridge3
NativeBridge4

Sections

.text
Size: 588KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5fd60c97bd30fd3751864514c38ddf84

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

kernel32

advapi32

ole32

oleaut32

shlwapi

iphlpapi

ws2_32

Exports

Exports

Sections

.text Size: 588KB - Virtual size: 588KB

.rdata Size: 147KB - Virtual size: 146KB

.data Size: 14KB - Virtual size: 18KB

.rsrc Size: 194KB - Virtual size: 194KB

.reloc Size: 36KB - Virtual size: 36KB

.text
Size: 588KB - Virtual size: 588KB

.rdata
Size: 147KB - Virtual size: 146KB

.data
Size: 14KB - Virtual size: 18KB

.rsrc
Size: 194KB - Virtual size: 194KB

.reloc
Size: 36KB - Virtual size: 36KB