f540c74e170f4600f90085d508a05edbfbc0884f772ff2603bb5672d3cc4e244

Sharing

Copy URL

Twitter E-mail

General

Target

f540c74e170f4600f90085d508a05edbfbc0884f772ff2603bb5672d3cc4e244
Size

1.9MB
MD5

6684f56142fceee4597d71514b84d8b2
SHA1

f0eebd4f8d1402b1d99e10278bc6f34bbf8ff1a0
SHA256

f540c74e170f4600f90085d508a05edbfbc0884f772ff2603bb5672d3cc4e244
SHA512

dbe5ffa0d2750bdcef0ba59453a5cc6298b6f5aa40ba80d155f70364e399118c534dbd4966a4ac4671e5e579e477e1ea9155e9cac97d5304ae87bda3f95bdce2
SSDEEP

49152:3YoNaBlNgx5ZhvrjPpc121qlrI7RhoQlqGwj:IoslNQrj+CqlrI7RhsGw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f540c74e170f4600f90085d508a05edbfbc0884f772ff2603bb5672d3cc4e244

Files

f540c74e170f4600f90085d508a05edbfbc0884f772ff2603bb5672d3cc4e244
.dll windows:5 windows x86 arch:x86

874c320b0b91fa99086c05a220fc0687

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenMutexW
EnterCriticalSection
Process32FirstW
SetStdHandle
OpenWaitableTimerW
GetFileTime
CreateHardLinkW
CallNamedPipeW
UnregisterWait
SetCriticalSectionSpinCount
ReplaceFileA
GetStartupInfoW
TlsFree
EnumSystemCodePagesA
SetLocaleInfoW
CreateEventA
GetPriorityClass
CreateFileMappingA
CallNamedPipeA
QueryDepthSList
WaitForSingleObjectEx
LocalLock
GetConsoleOutputCP
MoveFileA
GenerateConsoleCtrlEvent
IsWow64Process
FillConsoleOutputCharacterA
CreateProcessW
GetModuleHandleA
GetTimeFormatW
CloseHandle
SetUserGeoID
DuplicateHandle
SetMailslotInfo
GetSystemDefaultUILanguage
WaitForSingleObject
GetModuleFileNameA

msacm32

acmFormatEnumW

user32

ShowWindow
SwapMouseButton
LoadKeyboardLayoutW
SendMessageCallbackA
CreateWindowExA
GetClipboardFormatNameA
CopyImage
MessageBoxExW
SetTimer
EndMenu
keybd_event
TabbedTextOutA
GetUpdateRgn
CallMsgFilterA
ToAsciiEx
GetClipCursor
SetMenuDefaultItem
LockWindowUpdate
ExcludeUpdateRgn
IsCharLowerW
GetSystemMetrics
InflateRect
FreeDDElParam
CreateWindowExW
GetWindowContextHelpId
SetLayeredWindowAttributes
ToUnicodeEx
GetDlgItem
VkKeyScanExW
PostMessageW

secur32

InitializeSecurityContextA
MakeSignature
AcquireCredentialsHandleA
QueryContextAttributesA

wintrust

WintrustLoadFunctionPointers
IsCatalogFile
CryptCATAdminEnumCatalogFromHash
CryptCATAdminRemoveCatalog

oleaut32

CreateTypeLi
LoadTypeLibEx
GetActiveObject

opengl32

glEvalCoord1f

urlmon

CoInternetSetFeatureEnabled
IsAsyncMoniker

esent

JetInit2
JetEscrowUpdate

winspool.drv

DeletePrinterDriverExW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA

shell32

ExtractIconW
SHGetMalloc
SHChangeNotify
SHGetFileInfoA
SHGetSpecialFolderPathW
ExtractAssociatedIconA
SHGetPathFromIDListW
ShellExecuteExA
SHBrowseForFolderW

msvcrt

putc
toupper
wcscoll
memset
fgets
strtol

gdi32

SetDIBitsToDevice
GetTextMetricsA
ScaleWindowExtEx
GetObjectA
GetMetaFileA
PolyPolygon
GetCharWidthFloatA
SetColorSpace
CreateDiscardableBitmap
GetDCOrgEx
GetMapMode
SelectObject
SetMiterLimit
GetDeviceGammaRamp
Polygon

advapi32

QueryServiceStatusEx
StartServiceCtrlDispatcherA
GetKernelObjectSecurity
QueryServiceConfig2W
GetEffectiveRightsFromAclW
BuildTrusteeWithSidW
BuildTrusteeWithNameW
OpenSCManagerA
CreatePrivateObjectSecurityEx
AccessCheckByType
RegisterEventSourceA
AreAnyAccessesGranted
SetEntriesInAclW
GetServiceKeyNameA
RegEnumKeyA
RegNotifyChangeKeyValue
RegConnectRegistryA
LookupAccountNameW
CryptContextAddRef

netapi32

NetSessionGetInfo
NetGroupGetInfo
NetQueryDisplayInformation
NetUserSetGroups
NetGroupAddUser

mprapi

MprAdminMIBEntrySet
MprAdminConnectionEnum
MprConfigTransportCreate
MprConfigInterfaceDelete
MprAdminInterfaceCreate

crypt32

CryptBinaryToStringA
CertAlgIdToOID
PFXVerifyPassword
CryptMsgDuplicate
CertFindChainInStore
PFXExportCertStore

setupapi

SetupDiGetClassInstallParamsW
CM_Get_Device_ID_Size_Ex
SetupDiGetDeviceRegistryPropertyA
SetupGetLineTextW
SetupFindNextMatchLineW
SetupDiGetINFClassW
SetupDiGetClassImageListExW
CM_Disable_DevNode
CM_Locate_DevNode_ExW
CM_Open_Class_KeyW
SetupDiEnumDeviceInfo
CM_Get_Device_ID_List_SizeW
SetupDiGetDeviceInfoListDetailA

shlwapi

StrStrIA
PathGetCharTypeA
PathIsURLW
PathCreateFromUrlA
StrDupA
SHSetValueA

comctl32

ImageList_AddMasked

imm32

ImmGetCandidateListW

msvfw32

DrawDibStop

rasapi32

RasGetSubEntryPropertiesA
RasGetConnectStatusW

mscms

OpenColorProfileA
GetStandardColorSpaceProfileW

ws2_32

select

winscard

SCardListCardsA
SCardForgetCardTypeW
SCardListInterfacesA

ole32

OleLoadFromStream
CoQueryProxyBlanket
PropVariantCopy
StgCreatePropStg
OleMetafilePictFromIconAndLabel
CoFreeLibrary
CoLockObjectExternal

clusapi

RestoreClusterDatabase
CloseCluster

wininet

InternetTimeFromSystemTimeA
InternetSetCookieA
HttpSendRequestW

lz32

LZSeek
GetExpandedNameW
LZClose

rpcrt4

I_RpcGetExtendedError
RpcStringBindingParseA
NdrAsyncServerCall
RpcBindingInqAuthClientW
NdrAllocate

winmm

midiOutGetDevCapsW
waveInClose
GetDriverModuleHandle
waveInGetPosition
mmioDescend
midiOutMessage
mixerGetID
PlaySoundW
waveOutGetDevCapsW

Sections

.text
Size: 1020KB - Virtual size: 1017KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 756KB - Virtual size: 755KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

874c320b0b91fa99086c05a220fc0687

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msacm32

user32

secur32

wintrust

oleaut32

opengl32

urlmon

esent

winspool.drv

version

shell32

msvcrt

gdi32

advapi32

netapi32

mprapi

crypt32

setupapi

shlwapi

comctl32

imm32

msvfw32

rasapi32

mscms

ws2_32

winscard

ole32

clusapi

wininet

lz32

rpcrt4

winmm

Sections

.text Size: 1020KB - Virtual size: 1017KB

.qdata Size: 756KB - Virtual size: 755KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 96KB - Virtual size: 96KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 1020KB - Virtual size: 1017KB

.qdata
Size: 756KB - Virtual size: 755KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 96KB - Virtual size: 96KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 40KB - Virtual size: 39KB