5072b258393f4053268181d3825a64f15264993cd592b4e9690df5b0ddea519f

Sharing

Copy URL Twitter E-mail

General

Target

5072b258393f4053268181d3825a64f15264993cd592b4e9690df5b0ddea519f
Size

2.7MB
MD5

4bc55b03652feb4fe833f3aa06558734
SHA1

15022e5ae46c00cb10207a9019139482185516ba
SHA256

5072b258393f4053268181d3825a64f15264993cd592b4e9690df5b0ddea519f
SHA512

a49b6d3f983ada8ef45c79ea33588b97a386797cc4a27c1475f38b0c8bd48cc5974acf64f83be02902030de53742d4336300122782b1469f41c2c31c72e00478
SSDEEP

49152:IZgq88e/3cDSCxSOsaQbyOckmwFCko76FRvGENkUst5bZ4Xfx:IZiqxrzyyO6kqAdGOvXJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5072b258393f4053268181d3825a64f15264993cd592b4e9690df5b0ddea519f

Files

5072b258393f4053268181d3825a64f15264993cd592b4e9690df5b0ddea519f
.dll windows:5 windows x86 arch:x86

c2f770ef6d01540f032f6cfd43755162

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

netapi32

NetSessionGetInfo
NetSessionEnum
NetGroupAddUser
NetLocalGroupAddMembers
NetLocalGroupAdd

wintrust

CryptCATAdminEnumCatalogFromHash
IsCatalogFile
CryptCATHandleFromStore
CryptCATCDFClose

shell32

Shell_NotifyIconW
DuplicateIcon
CommandLineToArgvW
DoEnvironmentSubstW
SHEnumerateUnreadMailAccountsW
SHGetMalloc
SHGetSpecialFolderPathA

crypt32

CryptHashCertificate
CryptMsgVerifyCountersignatureEncodedEx
CryptVerifyDetachedMessageSignature
CryptVerifyMessageSignature
CryptVerifyCertificateSignature

msacm32

acmDriverAddW

lz32

GetExpandedNameW
LZSeek

oleaut32

LoadTypeLibEx
BSTR_UserUnmarshal
SafeArrayLock

ws2_32

select

msvcrt

memset
wcscoll
isupper
putc
isprint
fgets

kernel32

GetModuleFileNameA
SetFileAttributesA
SetTimerQueueTimer
SetStdHandle
UnregisterWaitEx
DeleteCriticalSection
QueueUserAPC
GlobalDeleteAtom
WaitForSingleObjectEx
LocalLock
EnumSystemCodePagesW
GlobalGetAtomNameA
WaitForSingleObject
EnterCriticalSection
Process32FirstW
GetTimeFormatA
IsWow64Process
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteConsoleOutputA
SetSystemTime
SetLastError
GetLongPathNameW
CreateFileA
CallNamedPipeA
VerLanguageNameA
FormatMessageW
EndUpdateResourceA
QueryDepthSList
GetDiskFreeSpaceA
LoadLibraryExA
GetModuleHandleA
GetTimeFormatW
CloseHandle

mprapi

MprConfigGetGuidName
MprAdminMIBEntryGetFirst
MprAdminServerConnect
MprInfoBlockAdd
MprConfigBufferFree

gdi32

SetBkColor
SelectClipRgn
Ellipse
Rectangle
GetViewportOrgEx
CreateICA
PolyPolygon
CreateRectRgnIndirect
BeginPath
GetMetaFileBitsEx
GetMetaFileA
CreatePen
RectVisible
AbortDoc
ExtEscape
GetStockObject
SetColorSpace

urlmon

URLOpenBlockingStreamA

user32

ClipCursor
DrawStateW
CreateWindowExA
GetWindowThreadProcessId
GetKeyNameTextA
InsertMenuItemW
IsWindowUnicode
GetCursorPos
DestroyMenu
GetKeyboardLayout
SetThreadDesktop
AllowSetForegroundWindow
GetClipboardFormatNameA
CreateIcon
InSendMessage
FreeDDElParam
IsCharLowerW
VkKeyScanExW
GetKeyboardLayoutList
ShowWindow
OemKeyScan
RegisterDeviceNotificationA
HideCaret
OpenInputDesktop
ScrollWindowEx
IsHungAppWindow
InSendMessageEx
CharNextExA
GetMonitorInfoA
GetUpdateRgn
DlgDirListA
CharNextW

shlwapi

PathIsDirectoryA
StrRChrW
SHQueryInfoKeyW
SHRegSetUSValueW
StrToIntA
StrStrA
PathIsPrefixA

winmm

OpenDriver
midiStreamOut
mmioWrite
mmioRead
waveOutSetPitch
waveInGetNumDevs
midiOutGetDevCapsW
waveInGetPosition
midiInUnprepareHeader

mscms

GetColorProfileElement
InstallColorProfileW

imm32

ImmSetConversionStatus

wininet

InternetCrackUrlA
InternetErrorDlg
InternetGetConnectedState

setupapi

CM_Get_Child_Ex
CM_Set_DevNode_Registry_PropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInterfaceA
CM_Get_HW_Prof_Flags_ExW
CM_Open_Class_KeyW
SetupDiSelectBestCompatDrv
CM_Get_Device_ID_Size_Ex
SetupInstallFromInfSectionW
SetupDiGetClassInstallParamsW
SetupDiEnumDeviceInfo
SetupDiSetDeviceRegistryPropertyW

winscard

SCardReleaseContext
SCardSetCardTypeProviderNameW

comctl32

ImageList_AddMasked

msvfw32

ICCompressorFree

rasapi32

RasGetCustomAuthDataW
RasGetSubEntryPropertiesA

ole32

HMENU_UserFree
StgIsStorageILockBytes
HGLOBAL_UserUnmarshal
OleFlushClipboard
OleConvertIStorageToOLESTREAMEx
CreateStreamOnHGlobal
CreatePointerMoniker

rpcrt4

RpcServerTestCancel
RpcGetAuthorizationContextForClient
NdrAllocate
NdrClientCall2
RpcServerUseProtseqExW

version

VerQueryValueW

opengl32

glPixelStorei

clusapi

ClusterResourceEnum
RestoreClusterDatabase

winspool.drv

AddMonitorW

advapi32

OpenSCManagerW
AccessCheckByTypeResultList
CryptReleaseContext
GetFileSecurityA
RegCloseKey
CryptDeriveKey
GetNumberOfEventLogRecords
CryptVerifySignatureA
GetSecurityDescriptorSacl
MakeSelfRelativeSD
CryptDestroyHash
StartServiceCtrlDispatcherA
OpenServiceA
GetCurrentHwProfileA
GetKernelObjectSecurity
LookupPrivilegeNameA
BackupEventLogW
RegRestoreKeyW

powrprof

WriteGlobalPwrPolicy

secur32

ImpersonateSecurityContext
InitializeSecurityContextA
SetContextAttributesW
EnumerateSecurityPackagesW

esent

JetUpdate
JetPrepareUpdate

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2f770ef6d01540f032f6cfd43755162

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

wintrust

shell32

crypt32

msacm32

lz32

oleaut32

ws2_32

msvcrt

kernel32

mprapi

gdi32

urlmon

user32

shlwapi

winmm

mscms

imm32

wininet

setupapi

winscard

comctl32

msvfw32

rasapi32

ole32

rpcrt4

version

opengl32

clusapi

winspool.drv

advapi32

powrprof

secur32

esent

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.qdata Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 72KB - Virtual size: 70KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 36KB - Virtual size: 33KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.qdata
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 72KB - Virtual size: 70KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 36KB - Virtual size: 33KB