f7af81345b959299ce584915b4cec250a67a43244206f51aee5aabb695344f14

Sharing

Copy URL Twitter E-mail

General

Target

f7af81345b959299ce584915b4cec250a67a43244206f51aee5aabb695344f14
Size

2.8MB
MD5

1ac9fd65fff952115eed9056fa9438a2
SHA1

a53f5ae6d6b078d176f43e06d17561be0ff39a29
SHA256

f7af81345b959299ce584915b4cec250a67a43244206f51aee5aabb695344f14
SHA512

e5cea5ed0c0bf5954b727971cc43284d55dfc11a9fbdb25f9d8c66d7d2d44af8580d1727b8ec617cdf350741854083daa3ddfe238f988b29bcc6388d6f7a4211
SSDEEP

49152:9lgysbgqy7GT7rMdAqM2is6ZJc85qwHDPYbaaiDYfMcKGR5its:jWgVqTnMdAqh6fc85qcrYmaKzGRo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7af81345b959299ce584915b4cec250a67a43244206f51aee5aabb695344f14

Files

f7af81345b959299ce584915b4cec250a67a43244206f51aee5aabb695344f14
.dll windows:5 windows x86 arch:x86

5be7d12637c6eea516f489950884146b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rpcrt4

RpcEpResolveBinding
I_RpcGetExtendedError
RpcBindingSetAuthInfoExA
RpcMgmtSetCancelTimeout
NdrUserMarshalBufferSize

gdi32

GetMapMode
InvertRgn
CreateICW
GetBoundsRect
GetCurrentObject
GetGlyphOutlineW
SetBkMode
RoundRect
ArcTo
GetROP2
CreateEllipticRgnIndirect
SetTextAlign

advapi32

GetServiceDisplayNameW
ImpersonateSelf
DuplicateTokenEx
CryptSignHashW
ChangeServiceConfigW
SaferComputeTokenFromLevel
GetTrusteeNameW
CryptGenKey
GetSidIdentifierAuthority
CryptExportKey
OpenServiceW
OpenBackupEventLogW
RegNotifyChangeKeyValue
GetLengthSid
ClearEventLogA
GetOldestEventLogRecord
SetSecurityDescriptorControl
RegRestoreKeyW
ReportEventW

ole32

RegisterDragDrop
GetHGlobalFromStream
CoInitializeSecurity
StgIsStorageFile
CoUnmarshalInterface
HICON_UserUnmarshal

winscard

SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardIntroduceCardTypeW

winmm

waveInClose
waveInGetDevCapsW
timeKillEvent
midiStreamRestart
waveOutOpen
mciGetErrorStringA
waveOutWrite
mmioRead

oleaut32

VariantInit
BSTR_UserMarshal
VarR4FromStr
SafeArrayPtrOfIndex

crypt32

CertDuplicateStore
PFXImportCertStore
CertNameToStrA
CertGetPublicKeyLength
CryptSignAndEncodeCertificate
CertCreateContext
CryptRegisterDefaultOIDFunction
CryptMsgClose
CryptSignMessage

comctl32

ImageList_Destroy

mprapi

MprConfigTransportGetHandle
MprAdminInterfaceSetCredentials
MprConfigInterfaceTransportGetHandle
MprAdminConnectionGetInfo
MprConfigInterfaceDelete

kernel32

RtlUnwind
WriteFile
HeapCreate
HeapDestroy
VirtualFree
InitializeCriticalSectionAndSpinCount
ReadFile
HeapAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetAtomNameW
GetTempFileNameA
GetConsoleWindow
GlobalFree
FileTimeToDosDateTime
FindAtomA
OpenMutexW
SetStdHandle
SetProcessShutdownParameters
ExpandEnvironmentStringsW
GetSystemTimeAdjustment
PostQueuedCompletionStatus
SetFilePointer
ReadConsoleA
GenerateConsoleCtrlEvent
GetLogicalDrives
DeleteFiber
TlsFree
VirtualAlloc
WritePrivateProfileStructA
LoadLibraryExW
GetDefaultCommConfigA
EnterCriticalSection
Process32FirstW
HeapFree
TlsSetValue
ClearCommBreak
GetPrivateProfileSectionNamesA
SetHandleInformation
GetComputerNameExA
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetModuleFileNameW
GetBinaryTypeA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
ExitProcess
Sleep
FatalAppExitA
GetStringTypeW
GetStringTypeA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LeaveCriticalSection
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetCurrentThread
GetLastError
GetCurrentThreadId
SetLastError
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCommandLineA
HeapSize
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
CompareStringA
CompareStringW
GetTapeParameters

version

VerFindFileW
GetFileVersionInfoSizeA

opengl32

glTranslatef

user32

InSendMessage
DlgDirSelectComboBoxExA
ScreenToClient
SetCaretPos
DlgDirSelectExA
VkKeyScanA
GetThreadDesktop
GetUpdateRgn
CreateDialogParamW
GrayStringW
ShowScrollBar
EnableScrollBar
WaitMessage
VkKeyScanExW
GetDoubleClickTime
DestroyCaret
GetOpenClipboardWindow
IsClipboardFormatAvailable
OpenDesktopW
GetCursor
GetMenuCheckMarkDimensions
CreateWindowExA
DialogBoxIndirectParamA
IsCharUpperA
OpenWindowStationW
CloseClipboard
ShowWindow

mscms

AssociateColorProfileWithDeviceW
DisassociateColorProfileFromDeviceW

wintrust

CryptCATEnumerateAttr

msacm32

acmStreamUnprepareHeader

winspool.drv

SetPortW

setupapi

SetupGetStringFieldW
SetupDiSetSelectedDriverA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInfoListDetailA
CM_Get_Device_ID_List_Size_ExW
CM_Connect_MachineW
SetupGetInfInformationW
SetupUninstallOEMInfW
CM_Get_Next_Log_Conf
SetupDiEnumDeviceInterfaces
SetupDiClassNameFromGuidExW
SetupDiSetSelectedDevice
SetupGetLineByIndexW

imm32

ImmSimulateHotKey

esent

JetMakeKey
JetRollback

netapi32

NetUserGetGroups
NetShareEnumSticky
NetGroupDel
NetLocalGroupGetInfo
NetApiBufferSize

rasapi32

RasEnumConnectionsA
RasGetSubEntryHandleA

lz32

GetExpandedNameW
LZCopy
LZOpenFileW

urlmon

CreateURLMoniker

ws2_32

select

clusapi

CloseCluster
ClusterRegCloseKey

wininet

InternetQueryOptionW
HttpSendRequestW
InternetWriteFile

shell32

SHLoadNonloadedIconOverlayIdentifiers
DuplicateIcon
SHOpenFolderAndSelectItems
SHGetFileInfoW

shlwapi

wvnsprintfW
PathFileExistsA
StrStrW
StrChrIA
PathIsUNCServerShareW
StrCpyNW
StrTrimA
PathCombineA
AssocIsDangerous
StrStrIA

msvfw32

ICDraw

secur32

QueryCredentialsAttributesW
QueryContextAttributesW
FreeContextBuffer
QuerySecurityPackageInfoW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5be7d12637c6eea516f489950884146b

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

gdi32

advapi32

ole32

winscard

winmm

oleaut32

crypt32

comctl32

mprapi

kernel32

version

opengl32

user32

mscms

wintrust

msacm32

winspool.drv

setupapi

imm32

esent

netapi32

rasapi32

lz32

urlmon

ws2_32

clusapi

wininet

shell32

shlwapi

msvfw32

secur32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.qdata Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 120KB - Virtual size: 125KB

.rsrc Size: 4KB - Virtual size: 904B

.reloc Size: 32KB - Virtual size: 28KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.qdata
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 120KB - Virtual size: 125KB

.rsrc
Size: 4KB - Virtual size: 904B

.reloc
Size: 32KB - Virtual size: 28KB