6c29b1a875158bec559435053e9cf04c174d56cac332b107920b78d8f37aa68a

Sharing

Copy URL Twitter E-mail

General

Target

6c29b1a875158bec559435053e9cf04c174d56cac332b107920b78d8f37aa68a
Size

2.9MB
MD5

4157ad664b86480221c8e2f2b38e4eef
SHA1

65d8956d88814e70f3460e378df59fd99b330b99
SHA256

6c29b1a875158bec559435053e9cf04c174d56cac332b107920b78d8f37aa68a
SHA512

72ffca0aeb10909a5e3be2cae97fee654a9d2c0f9a21f8f6d31e6651babb363b6903282bf7835bfa63e618f488f3761c57c7f9cf0291a9dacae1e798352be085
SSDEEP

49152:WdUsFQcffDMc3oIiFSAw5cRevT1M6n2IHPmc5ZJH/gKQm4c3rXD8sr//WlE1ErJ8:Wie17MKoIAVzkq4vmwJHj3rT8WWlFN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c29b1a875158bec559435053e9cf04c174d56cac332b107920b78d8f37aa68a

Files

6c29b1a875158bec559435053e9cf04c174d56cac332b107920b78d8f37aa68a
.dll windows:5 windows x86 arch:x86

015523b7189285b628b9409404dd3e67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rpcrt4

NdrUserMarshalFree

wininet

InternetOpenW

mprapi

MprAdminMIBBufferFree

advapi32

RegSaveKeyW
GetExplicitEntriesFromAclW
ObjectCloseAuditAlarmA
NotifyBootConfigStatus

urlmon

URLOpenStreamA
CoInternetCreateSecurityManager

shell32

SHGetFolderPathW
SHGetUnreadMailCountW

shlwapi

GetMenuPosFromID
ColorHLSToRGB
SHQueryInfoKeyW
PathRemoveArgsW

setupapi

SetupDiEnumDeviceInfo

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
CloseHandle
HeapSize
GetCommandLineA
FormatMessageA
CancelWaitableTimer
Module32NextW
CreateRemoteThread
LocalAlloc
CompareStringA
FreeEnvironmentStringsA
TlsFree
GetSystemTimeAsFileTime
OutputDebugStringA
GetModuleFileNameW
GlobalDeleteAtom
DuplicateHandle
GetSystemDefaultUILanguage
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryA
InterlockedExchange
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetLocaleInfoA
GetCurrentProcessId
FreeLibrary
SetConsoleCtrlHandler
SetStdHandle
SetFilePointer
GetModuleHandleA
CreateFileA
CompareStringW
SetConsoleOutputCP
GetStartupInfoA
GetModuleFileNameA
WriteFile
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
MultiByteToWideChar
SetHandleCount
GetStdHandle
GetFileType
SetEnvironmentVariableA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
SetLastError
GetCurrentThreadId
GetCurrentThread
GetTimeFormatA
GetDateFormatA
WideCharToMultiByte
HeapAlloc
ReadFile
InitializeCriticalSectionAndSpinCount
Sleep
ExitProcess
FatalAppExitA
RtlUnwind
HeapCreate

ole32

OleTranslateAccelerator
CoWaitForMultipleHandles

opengl32

glEvalCoord2f

gdi32

IntersectClipRect
GetCharWidthA
StretchBlt
EndDoc
GetCharABCWidthsW
GetMiterLimit

winmm

waveInMessage
mmioSeek
mixerSetControlDetails

esent

JetPrepareUpdate

crypt32

CertVerifySubjectCertificateContext
CertCloseStore

user32

GetAsyncKeyState
LoadCursorA
LockSetForegroundWindow
CharUpperBuffW
AttachThreadInput
SwitchToThisWindow
GetWindow

winscard

SCardLocateCardsW

lz32

GetExpandedNameW

rasapi32

RasSetSubEntryPropertiesW

Exports

Exports

EhckewmiraarldeQnd

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

015523b7189285b628b9409404dd3e67

Headers

File Characteristics

Imports

rpcrt4

wininet

mprapi

advapi32

urlmon

shell32

shlwapi

setupapi

kernel32

ole32

opengl32

gdi32

winmm

esent

crypt32

user32

winscard

lz32

rasapi32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.qdata Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 68KB - Virtual size: 73KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 24KB - Virtual size: 20KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.qdata
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 68KB - Virtual size: 73KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 24KB - Virtual size: 20KB