810863cc7658c21d768d6196103906e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

810863cc7658c21d768d6196103906e0N.exe
Size

3.1MB
MD5

810863cc7658c21d768d6196103906e0
SHA1

dc54838e55fb037782a1b8ddcb72b83d0e3398f8
SHA256

7b863f3bdc046edc6f810cb9282009f734e9cb89bd3e4aa0965ddde4f8b442d7
SHA512

101678061625b1e28a923699d34f168728adc384afd79847767fd8052251efe90a90f2827f5a90ce761529480034c33216e4fe1b7524cf62c2c5e1cfb9f44f03
SSDEEP

49152:yxUt+c3XS5XL0r+CCB5+1HSzXF0zo6WroqoWtPv1ScbB4z:kkS5Xy+CCB5+hwF0zoproq3W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
810863cc7658c21d768d6196103906e0N.exe

Files

810863cc7658c21d768d6196103906e0N.exe
.dll regsvr32 windows:10 windows x86 arch:x86

f0a2952563a9e185fb87d9cccb5e7acb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PrintConfig.pdb

Imports

msvcrt

??0exception@@QAE@ABQBDH@Z
_callnewh
fputc
wcstoul
realloc
strchr
fclose
fwrite
__mb_cur_max
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
wcschr
ungetwc
ungetc
fputwc
fgetwc
fgetc
strncmp
_wtoi
wcstol
_wtof
_time64
ldexp
_errno
_wtol
strcspn
localeconv
memcpy
memmove
_wcsdup
??8type_info@@QBEHABV0@@Z
__crtCompareStringW
sprintf_s
calloc
wcscat_s
wcsncpy_s
_wcsnicmp
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
___lc_handle_func
__uncaught_exception
setlocale
_lock
_unlock
___mb_cur_max_func
___lc_codepage_func
_ismbblead
memset
__pctype_func
fseek
fprintf
_wsplitpath_s
_wmakepath_s
vfprintf
towupper
_wfsopen
___lc_collate_cp_func
memcmp
abort
isalnum
isdigit
floor
_ftol2
_ftol2_sse
_XcptFilter
_amsg_exit
_initterm
__dllonexit
_onexit
?terminate@@YAXXZ
isupper
isspace
tolower
memchr
islower
_CxxThrowException
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
wcscpy_s
_stricmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_except_handler4_common
??1type_info@@UAE@XZ
ceil
swprintf_s
wcsncmp
atoi
_itow
wcstok_s
_vsnprintf
qsort
wcstod
iswspace
_ultoa_s
strrchr
iswctype
_strnicmp
wcsnlen
_vsnprintf_s
_vsnwprintf
wcsrchr
wcsstr
memmove_s
memcpy_s
_resetstkoflw
free
malloc
_wcsicmp
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
__CxxFrameHandler3

kernel32

GetPrivateProfileStringW
GetFinalPathNameByHandleW
VirtualProtect
LoadLibraryExA
GetSystemInfo
VirtualQuery
OutputDebugStringA
SetThreadUILanguage
GetSystemDirectoryW
LocaleNameToLCID
SetThreadPreferredUILanguages
LoadLibraryW
MulDiv
GetTempFileNameW
HeapCreate
SetErrorMode
SetFilePointer
GetFileTime
GetPrivateProfileIntW
GetPrivateProfileSectionW
LockResource
FindResourceW
GetSystemDefaultLCID
GetACP
GetUserDefaultUILanguage
VirtualFree
GetCPInfo
VirtualAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
DecodePointer
EncodePointer
GetStringTypeW
GetLastError
DeleteCriticalSection
CloseHandle
FreeLibrary
GetProcAddress
CreateFileW
ReadFile
InitializeCriticalSectionEx
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
GetModuleHandleW
GetFileSize
GetCurrentThreadId
HeapAlloc
HeapFree
FormatMessageW
SetLastError
GetCurrentProcess
GetCurrentThread
GetProcessHeap
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
MapViewOfFile
UnmapViewOfFile
ReleaseSRWLockShared
ReleaseSRWLockExclusive
DeleteFileW
OpenSemaphoreW
CreateThreadpoolTimer
OpenMutexW
CreateMutexW
RemoveDirectoryW
CreateDirectoryW
WriteFile
SetFileInformationByHandle
CreateFileMappingW
CreateProcessW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
SetEvent
GetModuleFileNameW
CreateEventW
CreateActCtxW
ReleaseActCtx
QueueUserWorkItem
InitOnceBeginInitialize
InitOnceComplete
LocalFree
InitializeCriticalSection
ResetEvent
CloseThreadpoolWait
Sleep
CreateEventExW
GetTickCount64
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
MultiByteToWideChar
RaiseException
LoadResource
SizeofResource
FindResourceExW
LoadLibraryExW
lstrcmpiW
TerminateJobObject
CreateWaitableTimerW
WaitForMultipleObjects
IsWow64Process
WideCharToMultiByte
GetSystemWindowsDirectoryW
SetWaitableTimer
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
GetFullPathNameW
CopyFileW
CompareStringOrdinal
GlobalLock
GlobalSize
GlobalUnlock
OpenProcess
LocalAlloc
GetProcessId
CreateJobObjectW
AssignProcessToJobObject
ResumeThread
TerminateProcess
IsProcessInJob
CompareFileTime
CreateThread
GetComputerNameW
SystemTimeToTzSpecificLocalTime
OpenEventW
lstrcmpW
GetLocaleInfoW
EnumUILanguagesW
GetThreadPreferredUILanguages
HeapSize
HeapReAlloc
HeapDestroy

oleaut32

UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
LoadRegTypeLi
VariantCopy
SystemTimeToVariantTime
VarBstrCat
BSTR_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VariantChangeType
LoadTypeLi
SysFreeString
SysStringLen
SysAllocString
VariantInit
VariantClear
VarUI4FromStr

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitializeEx
CLSIDFromProgID
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
PropVariantClear
StgCreateStorageEx
StgOpenStorageEx
CoGetCallerTID
CoRevertToSelf
CoImpersonateClient
GetHGlobalFromStream
CoTaskMemFree
CoGetContextToken
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoGetClassObject
CoSuspendClassObjects
CoResumeClassObjects

rpcrt4

UuidFromStringW
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
RpcServerInqCallAttributesW
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
RpcStringFreeW
UuidToStringW
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
UuidCreate

winspool.drv

FindNextPrinterChangeNotification
FreePrinterNotifyInfo
EnumPrintersW
FindFirstPrinterChangeNotification
FindClosePrinterChangeNotification
EnumJobsW
EnumFormsW
GetFormW
SetPrinterW
OpenPrinterW
ClosePrinter
GetPrinterDataExW
GetPrinterDataW
OpenPrinter2W
SetPrinterDataW
GetPrinterDriverW
GetPrinterDriverDirectoryW
GetPrinterW
EnumPrinterDataExW
DeviceCapabilitiesW
DeleteFormW
DeletePrinterDataW
AddFormW
SetPrinterDataExW
DeletePrinterDataExW
SetJobW

advapi32

ConvertSidToStringSidW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
OpenThreadToken
TraceMessage
CreateWellKnownSid
AddAccessAllowedAceEx
RegGetValueW
RegDeleteKeyW
SetThreadToken
EventUnregister
EventRegister
EventWriteTransfer
RegEnumKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
SaferCloseLevel
SaferComputeTokenFromLevel
SaferCreateLevel
CreateProcessAsUserW
DuplicateTokenEx
CreateRestrictedToken
EventActivityIdControl
IsWellKnownSid
RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyW
RegCreateKeyW
DeleteService
OpenServiceW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CloseServiceHandle
RegQueryInfoKeyW

shlwapi

ord12
SHCreateStreamOnFileEx

prntvpt

ord1
ord3
ord6
ord9
ord8
ord10
ord7
ord4
ord2

user32

PostMessageW
ShowWindow
CharNextW
GetAppCompatFlags2
GetGUIThreadInfo
GetParent
GetWindowLongW
SetWindowLongW
GetAncestor
SetFocus
LoadStringW
GetWindowThreadProcessId
AllowSetForegroundWindow
UnregisterClassA
DialogBoxParamW
LoadIconW
SetDlgItemTextA
SetDlgItemTextW
EndDialog
CheckRadioButton
MessageBoxW
MessageBeep
WinHelpW
SendDlgItemMessageW
GetDlgItemTextW
SetCursor
LoadCursorW
InvalidateRect
CheckDlgButton
DispatchMessageW
GetDlgItem
SendMessageW
SetForegroundWindow
SetActiveWindow
EnableWindow
GetFocus
GetActiveWindow
IsGUIThread
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW

gdi32

GetDeviceCaps
ExtEscape
EnumFontFamiliesW
SetGraphicsMode
CreateDCW
CreateICW
DeleteDC

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile

Exports

Exports

DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvResetConfigCache
DrvSplDeviceCaps
DrvUpgradePrinter
GetStandardMessageForPrinterStatus
MxdcGetPDEVAdjustment
NotifyEntry
ServiceMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0a2952563a9e185fb87d9cccb5e7acb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

oleaut32

ole32

rpcrt4

winspool.drv

advapi32

shlwapi

prntvpt

user32

version

gdi32

userenv

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.data Size: 77KB - Virtual size: 81KB

.idata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 64B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 254KB - Virtual size: 254KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 77KB - Virtual size: 81KB

.idata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 64B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 254KB - Virtual size: 254KB