08eb3555b8143549981520bb3954590937ace1d5137b061b9224af6c8963936b

Sharing

Copy URL

Twitter E-mail

General

Target

08eb3555b8143549981520bb3954590937ace1d5137b061b9224af6c8963936b
Size

2.4MB
MD5

c6f437ad06a2fa40f805d7214f56d265
SHA1

d4f02d9a64c35ba611d38396a56ea811d016d62f
SHA256

08eb3555b8143549981520bb3954590937ace1d5137b061b9224af6c8963936b
SHA512

01d177f3858d411ec72645cdc2903bae65f2e48ba349b065a2e1a0c0ba855b09b1721b488cc0ffab67e62582f33273d966fca0f22326cb16d38c549fcdee5a16
SSDEEP

49152:Gvm/TMlg2Q4Tao/CWtlwLNv/AaFogXg3nnKr9d:Gu/I2bUCSqNXoFnKf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08eb3555b8143549981520bb3954590937ace1d5137b061b9224af6c8963936b

Files

08eb3555b8143549981520bb3954590937ace1d5137b061b9224af6c8963936b
.dll windows:5 windows x86 arch:x86

5525fa5d13e5cdc27873165c188053ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

GetMetaFileA
GetStockObject
SetColorSpace
AbortDoc
CreatePen
RectVisible
GetViewportOrgEx
BeginPath
ExtEscape
PolyPolygon
CreateRectRgnIndirect
GetMetaFileBitsEx
CreateICA

esent

JetUpdate
JetPrepareUpdate

wintrust

CryptCATCDFClose
IsCatalogFile
CryptCATHandleFromStore
CryptCATAdminEnumCatalogFromHash

imm32

ImmSetConversionStatus

crypt32

CryptHashCertificate
CryptVerifyDetachedMessageSignature
CryptVerifyMessageSignature
CryptMsgVerifyCountersignatureEncodedEx
CryptEncodeObjectEx

shlwapi

StrStrA
PathIsDirectoryA
PathIsUNCA
SHQueryInfoKeyW
StrToIntA
SHRegSetUSValueW
StrRChrW

user32

GetClipboardFormatNameA
GetKeyboardLayoutList
IsHungAppWindow
InSendMessage
InSendMessageEx
InsertMenuItemW
RegisterDeviceNotificationA
VkKeyScanExW
CreateWindowExA
OemKeyScan
CharNextW
GetUpdateRgn
ScrollWindowEx
GetMonitorInfoA
ShowWindow
OpenInputDesktop
ClipCursor
CreateIcon
DlgDirListA
CharNextExA
AllowSetForegroundWindow
SetThreadDesktop
CharPrevA
CreateMDIWindowA
DrawFocusRect
IsCharLowerW
GetRawInputDeviceList
DrawStateW

rpcrt4

NdrClientCall2
NdrAllocate
RpcSsGetContextBinding
RpcServerUseProtseqExW
RpcGetAuthorizationContextForClient

msvfw32

ICCompressorFree

shell32

DuplicateIcon
SHGetFolderPathA
SHGetSpecialFolderPathA
SHEnumerateUnreadMailAccountsW
SHGetMalloc
Shell_NotifyIconW
DoEnvironmentSubstW

clusapi

ClusterRegSetValue
ClusterResourceEnum

msacm32

acmDriverAddW

msvcrt

isupper
fgets
wcscoll
isprint
putc

ws2_32

select

winmm

PlaySoundA
mmioRead
midiInMessage
midiStreamOut
midiOutGetDevCapsW
waveOutSetPitch
OpenDriver
mmioWrite
PlaySoundW

setupapi

SetupDiOpenDeviceInterfaceA
SetupDiSetDeviceRegistryPropertyW
CM_Get_Child_Ex
SetupDiGetClassInstallParamsW
CM_Get_Device_ID_Size_Ex
SetupDiEnumDeviceInfo
CM_Get_HW_Prof_Flags_ExW
SetupDiSelectBestCompatDrv
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
CM_Open_Class_KeyW
CM_Set_DevNode_Registry_PropertyW

urlmon

URLOpenBlockingStreamA

mscms

GetColorProfileElement
EnumColorProfilesW

advapi32

GetSecurityDescriptorOwner
RegRestoreKeyA
CryptVerifySignatureA
OpenSCManagerW
AccessCheckByTypeResultList
GetSecurityDescriptorSacl
GetNumberOfEventLogRecords
CryptDeriveKey
RegCloseKey
OpenServiceA
StartServiceCtrlDispatcherA
GetKernelObjectSecurity
GetFileSecurityA
GetCurrentHwProfileA
MakeSelfRelativeSD
LookupPrivilegeNameA
RegRestoreKeyW
CryptDestroyHash

kernel32

SetLastError
SetTimerQueueTimer
GlobalGetAtomNameA
CallNamedPipeA
QueryDepthSList
LoadLibraryExA
GetLongPathNameW
GetDiskFreeSpaceA
SetFileAttributesA
VerLanguageNameA
CreateFileA
WaitForSingleObjectEx
QueueUserAPC
EnterCriticalSection
WriteConsoleOutputA
SetStdHandle
DeleteCriticalSection
LocalLock
UnregisterWaitEx
FormatMessageW
GetProcessId
IsWow64Process
SetSystemTime
WaitForSingleObject
EndUpdateResourceA
GetProcessShutdownParameters
GetUserGeoID
GetModuleHandleA
GetTimeFormatW
CloseHandle
GetModuleFileNameA
GlobalDeleteAtom
Process32FirstW
GetEnvironmentStringsW

winspool.drv

AddMonitorW

comctl32

ImageList_AddMasked

netapi32

NetSessionGetInfo
NetGroupAddUser
NetLocalGroupAdd
NetLocalGroupAddMembers
NetSessionEnum

lz32

GetExpandedNameW
LZCopy

version

VerQueryValueW

rasapi32

RasGetSubEntryPropertiesA
RasGetCustomAuthDataW

wininet

InternetOpenUrlW
InternetCrackUrlA
ReadUrlCacheEntryStream

ole32

StgIsStorageILockBytes
OleRegEnumFormatEtc
OleConvertIStorageToOLESTREAMEx
HGLOBAL_UserUnmarshal
OleDraw
CreatePointerMoniker
StgCreateStorageEx

winscard

SCardReleaseContext
SCardSetCardTypeProviderNameW

opengl32

glPixelStorei

oleaut32

SafeArrayLock
LoadTypeLibEx
BSTR_UserUnmarshal

secur32

QueryContextAttributesW
GetUserNameExA
ImpersonateSecurityContext
SetContextAttributesW

mprapi

MprInfoBlockAdd
MprConfigGetGuidName
MprAdminServerConnect
MprAdminMIBEntryGetFirst
MprAdminInterfaceConnect

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 960KB - Virtual size: 958KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5525fa5d13e5cdc27873165c188053ce

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

esent

wintrust

imm32

crypt32

shlwapi

user32

rpcrt4

msvfw32

shell32

clusapi

msacm32

msvcrt

ws2_32

winmm

setupapi

urlmon

mscms

advapi32

kernel32

winspool.drv

comctl32

netapi32

lz32

version

rasapi32

wininet

ole32

winscard

opengl32

oleaut32

secur32

mprapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.qdata Size: 960KB - Virtual size: 958KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 116KB - Virtual size: 116KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 52KB - Virtual size: 48KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.qdata
Size: 960KB - Virtual size: 958KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 116KB - Virtual size: 116KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 52KB - Virtual size: 48KB