3f76f44fabdc024abbda3763b09e57b375a9154323dee8177f7411e8061e3b2b

Sharing

Copy URL Twitter E-mail

General

Target

3f76f44fabdc024abbda3763b09e57b375a9154323dee8177f7411e8061e3b2b
Size

8.9MB
MD5

3ce530c2d9f7022fc57475ea26165ba2
SHA1

d3bab1247902c17bfc39ab7827abc51ac8aef305
SHA256

3f76f44fabdc024abbda3763b09e57b375a9154323dee8177f7411e8061e3b2b
SHA512

649ff212b1e1884b64022318a3e029f5efc066164ead5511fd70928a550ce98f9b8c7ef95f138ecde15be60e33a793cebccfb9dcbf8a73f81e63b9bd4c0f1838
SSDEEP

196608:gFXAejZ2f4MsspK7Ji6G7OggPjP+ORPW9Tg2KOS0Auh:gFQBgMki6G7OgIL+OROK+T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f76f44fabdc024abbda3763b09e57b375a9154323dee8177f7411e8061e3b2b

Files

3f76f44fabdc024abbda3763b09e57b375a9154323dee8177f7411e8061e3b2b
.dll windows:6 windows x64 arch:x64

b722e0ec193df6b12c8639b6b16438a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

FindWindowExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

CryptGetProvParam

shell32

ord680

ole32

CreateStreamOnHGlobal

oleaut32

SafeArrayGetLBound

ws2_32

closesocket

shlwapi

PathCombineW

wintrust

WinVerifyTrust

ntdll

RtlVirtualUnwind

rpcrt4

RpcServerUnregisterIf

dbghelp

ImageDirectoryEntryToData

mpr

WNetGetProviderNameW

iphlpapi

GetNetworkParams

setupapi

SetupDiGetClassDevsW

bcrypt

BCryptGenRandom

gdiplus

GdipGetImageWidth

gdi32

BitBlt

crypt32

CertGetCertificateContextProperty

psapi

GetModuleFileNameExW

wtsapi32

WTSSendMessageW

Exports

Exports

NEP_StartScan

Sections

.text
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 929KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ndata1
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ndata0
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.200
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.201
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b722e0ec193df6b12c8639b6b16438a2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

ntdll

rpcrt4

dbghelp

mpr

iphlpapi

setupapi

bcrypt

gdiplus

gdi32

crypt32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 3.4MB

.rdata Size: - Virtual size: 929KB

.data Size: - Virtual size: 195KB

.pdata Size: - Virtual size: 146KB

.ndata1 Size: - Virtual size: 8KB

.ndata0 Size: - Virtual size: 24B

_RDATA Size: - Virtual size: 244B

.200 Size: - Virtual size: 3.3MB

.201 Size: 8.9MB - Virtual size: 8.9MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 1024B - Virtual size: 2.6MB

.text
Size: - Virtual size: 3.4MB

.rdata
Size: - Virtual size: 929KB

.data
Size: - Virtual size: 195KB

.pdata
Size: - Virtual size: 146KB

.ndata1
Size: - Virtual size: 8KB

.ndata0
Size: - Virtual size: 24B

_RDATA
Size: - Virtual size: 244B

.200
Size: - Virtual size: 3.3MB

.201
Size: 8.9MB - Virtual size: 8.9MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 1024B - Virtual size: 2.6MB