3f4d9d6cc8633243f5661344091ee5267c2f81af920f057d50c906486b0d4a00

Sharing

Copy URL Twitter E-mail

General

Target

3f4d9d6cc8633243f5661344091ee5267c2f81af920f057d50c906486b0d4a00
Size

1.9MB
MD5

b06c7493261a961fd6c596b95f949fed
SHA1

3907ea5d120b193507d1afa9a2d3bca3ae01ac7b
SHA256

3f4d9d6cc8633243f5661344091ee5267c2f81af920f057d50c906486b0d4a00
SHA512

1ab7e624e77a51c4e80d7c332922ae348a13c7c8e1772777be1ad36fb29c81b11724b20522c6235c19d41377eb53977c8d98733c2b3312f766d7398406da13eb
SSDEEP

49152:d7bfBmwdze9YO8bbIAv1IvDLepDuDCyxXbPMkT2:5BBz6Y5bbIQIMDDgXFT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f4d9d6cc8633243f5661344091ee5267c2f81af920f057d50c906486b0d4a00

Files

3f4d9d6cc8633243f5661344091ee5267c2f81af920f057d50c906486b0d4a00
.dll windows:5 windows x86 arch:x86

947fef6d15d03c2125f46b147edf952f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

esent

JetInit2
JetEscrowUpdate

ole32

PropVariantCopy
CoLockObjectExternal
CoFreeLibrary
OleLoadFromStream
OleMetafilePictFromIconAndLabel
StgCreatePropStg
CoQueryProxyBlanket

imm32

ImmGetCandidateListW

winmm

mixerGetID
midiOutGetDevCapsW
PlaySoundW
waveOutGetDevCapsW
GetDriverModuleHandle
waveInGetPosition
mmioDescend
waveInClose
midiOutMessage

setupapi

CM_Locate_DevNode_ExW
SetupDiGetDeviceInfoListDetailA
CM_Disable_DevNode
SetupDiGetClassImageListExW
CM_Get_Device_ID_List_SizeW
SetupDiGetINFClassW
CM_Open_Class_KeyW
CM_Get_Device_ID_Size_Ex
SetupDiGetDeviceRegistryPropertyA
SetupGetLineTextW
SetupFindNextMatchLineW
SetupDiGetClassInstallParamsW
SetupDiEnumDeviceInfo

comctl32

ImageList_AddMasked

wininet

InternetSetCookieA
InternetTimeFromSystemTimeA
HttpSendRequestW

wintrust

IsCatalogFile
WintrustLoadFunctionPointers
CryptCATAdminRemoveCatalog
CryptCATAdminEnumCatalogFromHash

user32

SwapMouseButton
ShowWindow
VkKeyScanExW
CallMsgFilterA
SetLayeredWindowAttributes
GetWindowContextHelpId
CreateWindowExW
FreeDDElParam
GetDlgItem
InflateRect
GetClipboardFormatNameA
PostMessageW
SendMessageCallbackA
SetTimer
MessageBoxExW
CopyImage
CreateWindowExA
GetSystemMetrics
IsCharLowerW
ExcludeUpdateRgn
ToAsciiEx
GetClipCursor
SetMenuDefaultItem
LoadKeyboardLayoutW
ToUnicodeEx
EndMenu
keybd_event
TabbedTextOutA
GetUpdateRgn
LockWindowUpdate

winspool.drv

DeletePrinterDriverExW

rpcrt4

NdrAllocate
RpcBindingInqAuthClientW
NdrAsyncServerCall
RpcStringBindingParseA
I_RpcGetExtendedError

urlmon

CoInternetSetFeatureEnabled
IsAsyncMoniker

opengl32

glEvalCoord1f

crypt32

CryptMsgDuplicate
CertAlgIdToOID
CertFindChainInStore
CryptBinaryToStringA
PFXVerifyPassword
PFXExportCertStore

kernel32

GetTimeFormatW
GetModuleHandleA
IsWow64Process
GenerateConsoleCtrlEvent
MoveFileA
GetConsoleOutputCP
FillConsoleOutputCharacterA
GetStartupInfoW
GetSystemDefaultUILanguage
UnregisterWait
CreateProcessW
TlsFree
EnterCriticalSection
Process32FirstW
SetStdHandle
OpenWaitableTimerW
GetFileTime
CloseHandle
CallNamedPipeW
WaitForSingleObject
SetCriticalSectionSpinCount
EnumSystemCodePagesA
SetLocaleInfoW
CreateEventA
GetPriorityClass
CreateFileMappingA
CallNamedPipeA
QueryDepthSList
WaitForSingleObjectEx
LocalLock
OpenMutexW
SetMailslotInfo
DuplicateHandle
SetUserGeoID
CreateHardLinkW
GetModuleFileNameA
ReplaceFileA

shell32

ExtractIconW
SHGetPathFromIDListW
ExtractAssociatedIconA
SHChangeNotify
SHGetMalloc
ShellExecuteExA
SHGetSpecialFolderPathW
SHGetFileInfoA
SHBrowseForFolderW

lz32

LZClose
LZSeek
GetExpandedNameW

advapi32

StartServiceCtrlDispatcherA
RegEnumKeyA
RegNotifyChangeKeyValue
RegConnectRegistryA
LookupAccountNameW
CryptContextAddRef
QueryServiceStatusEx
GetKernelObjectSecurity
QueryServiceConfig2W
GetEffectiveRightsFromAclW
BuildTrusteeWithSidW
SetEntriesInAclW
AreAnyAccessesGranted
BuildTrusteeWithNameW
OpenSCManagerA
CreatePrivateObjectSecurityEx
AccessCheckByType
RegisterEventSourceA
GetServiceKeyNameA

shlwapi

PathIsURLW
PathCreateFromUrlA
StrDupA
StrStrIA
SHSetValueA
PathGetCharTypeA

clusapi

CloseCluster
RestoreClusterDatabase

mscms

GetStandardColorSpaceProfileW
OpenColorProfileA

netapi32

NetQueryDisplayInformation
NetGroupAddUser
NetGroupGetInfo
NetUserSetGroups
NetSessionGetInfo

ws2_32

select

gdi32

SetDIBitsToDevice
GetTextMetricsA
PolyPolygon
GetDeviceGammaRamp
Polygon
ScaleWindowExtEx
GetObjectA
GetMetaFileA
SetMiterLimit
GetCharWidthFloatA
SetColorSpace
GetMapMode
GetDCOrgEx
CreateDiscardableBitmap
SelectObject

msvfw32

DrawDibStop

oleaut32

GetActiveObject
LoadTypeLibEx
CreateTypeLi

winscard

SCardListCardsA
SCardForgetCardTypeW
SCardListInterfacesA

msacm32

acmFormatEnumW

mprapi

MprAdminMIBEntrySet
MprConfigInterfaceDelete
MprConfigTransportCreate
MprAdminConnectionEnum
MprAdminInterfaceCreate

msvcrt

memset
wcscoll
fgets
strtol
putc
toupper

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

rasapi32

RasGetSubEntryPropertiesA
RasGetConnectStatusW

secur32

AcquireCredentialsHandleA
MakeSignature
InitializeSecurityContextA
QueryContextAttributesA

Sections

.text
Size: 1020KB - Virtual size: 1017KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 760KB - Virtual size: 756KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

947fef6d15d03c2125f46b147edf952f

Headers

DLL Characteristics

File Characteristics

Imports

esent

ole32

imm32

winmm

setupapi

comctl32

wininet

wintrust

user32

winspool.drv

rpcrt4

urlmon

opengl32

crypt32

kernel32

shell32

lz32

advapi32

shlwapi

clusapi

mscms

netapi32

ws2_32

gdi32

msvfw32

oleaut32

winscard

msacm32

mprapi

msvcrt

version

rasapi32

secur32

Sections

.text Size: 1020KB - Virtual size: 1017KB

.qdata Size: 760KB - Virtual size: 756KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 96KB - Virtual size: 97KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 1020KB - Virtual size: 1017KB

.qdata
Size: 760KB - Virtual size: 756KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 96KB - Virtual size: 97KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 40KB - Virtual size: 39KB