0e985e2591e041af9b81f6d315112e933322876ab9d2dc296490ad4da469a49b

Sharing

Copy URL Twitter E-mail

General

Target

0e985e2591e041af9b81f6d315112e933322876ab9d2dc296490ad4da469a49b
Size

2.4MB
MD5

f147f8cc0254c47168bd9b185ec26c0a
SHA1

2f6b59ef233acf38e3c2820ac699d183fc6764a6
SHA256

0e985e2591e041af9b81f6d315112e933322876ab9d2dc296490ad4da469a49b
SHA512

47ee8f5493aae023fc81c73027b375418bb96c56052e59ac12906f0d8b66f0f890e81d8750ca2633f7ba4712231ab4f7761a347d0a849894134ad2d5dc4ca437
SSDEEP

49152:tvm/TMlg2Q4Tao/CWtlwLmv/AaFogXg3nnKr9d:tu/I2bUCSqmXoFnKf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e985e2591e041af9b81f6d315112e933322876ab9d2dc296490ad4da469a49b

Files

0e985e2591e041af9b81f6d315112e933322876ab9d2dc296490ad4da469a49b
.dll windows:5 windows x86 arch:x86

b5c11e385a6629e17d66fd5bee13c089

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

GetMetaFileA
GetStockObject
SetColorSpace
AbortDoc
CreatePen
RectVisible
GetViewportOrgEx
BeginPath
ExtEscape
PolyPolygon
CreateRectRgnIndirect
GetMetaFileBitsEx
CreateICA

esent

JetUpdate
JetPrepareUpdate

wintrust

CryptCATCDFClose
IsCatalogFile
CryptCATHandleFromStore
CryptCATAdminEnumCatalogFromHash

opengl32

glPixelStorei

crypt32

CryptHashCertificate
CryptVerifyDetachedMessageSignature
CryptVerifyMessageSignature
CryptMsgVerifyCountersignatureEncodedEx
CryptEncodeObjectEx

shlwapi

StrStrA
PathIsDirectoryA
PathIsUNCA
SHQueryInfoKeyW
StrToIntA
SHRegSetUSValueW
StrRChrW

user32

GetClipboardFormatNameA
GetKeyboardLayoutList
IsHungAppWindow
InSendMessage
InSendMessageEx
InsertMenuItemW
RegisterDeviceNotificationA
VkKeyScanExW
CreateWindowExA
OemKeyScan
CharNextW
GetUpdateRgn
ScrollWindowEx
GetMonitorInfoA
ShowWindow
OpenInputDesktop
ClipCursor
CreateIcon
DlgDirListA
CharNextExA
AllowSetForegroundWindow
SetThreadDesktop
CharPrevA
CreateMDIWindowA
DrawFocusRect
IsCharLowerW
GetRawInputDeviceList
DrawStateW

rpcrt4

NdrClientCall2
NdrAllocate
RpcSsGetContextBinding
RpcServerUseProtseqExW
RpcGetAuthorizationContextForClient

msvfw32

ICCompressorFree

ole32

StgIsStorageILockBytes
OleRegEnumFormatEtc
OleConvertIStorageToOLESTREAMEx
HGLOBAL_UserUnmarshal
OleDraw
CreatePointerMoniker
StgCreateStorageEx

clusapi

ClusterRegSetValue
ClusterResourceEnum

msacm32

acmDriverAddW

msvcrt

isupper
fgets
wcscoll
isprint
putc

ws2_32

select

winmm

PlaySoundA
mmioRead
midiInMessage
midiStreamOut
midiOutGetDevCapsW
waveOutSetPitch
OpenDriver
mmioWrite
PlaySoundW

setupapi

SetupDiOpenDeviceInterfaceA
SetupDiSetDeviceRegistryPropertyW
CM_Get_Child_Ex
SetupDiGetClassInstallParamsW
CM_Get_Device_ID_Size_Ex
SetupDiEnumDeviceInfo
CM_Get_HW_Prof_Flags_ExW
SetupDiSelectBestCompatDrv
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
CM_Open_Class_KeyW
CM_Set_DevNode_Registry_PropertyW

urlmon

URLOpenBlockingStreamA

mscms

GetColorProfileElement
EnumColorProfilesW

advapi32

GetSecurityDescriptorOwner
RegRestoreKeyA
CryptVerifySignatureA
OpenSCManagerW
AccessCheckByTypeResultList
GetSecurityDescriptorSacl
GetNumberOfEventLogRecords
CryptDeriveKey
RegCloseKey
OpenServiceA
StartServiceCtrlDispatcherA
GetKernelObjectSecurity
GetFileSecurityA
GetCurrentHwProfileA
MakeSelfRelativeSD
LookupPrivilegeNameA
RegRestoreKeyW
CryptDestroyHash

kernel32

SetLastError
SetTimerQueueTimer
GlobalGetAtomNameA
CallNamedPipeA
QueryDepthSList
LoadLibraryExA
GetLongPathNameW
GetDiskFreeSpaceA
SetFileAttributesA
VerLanguageNameA
CreateFileA
WaitForSingleObjectEx
QueueUserAPC
EnterCriticalSection
WriteConsoleOutputA
SetStdHandle
DeleteCriticalSection
LocalLock
UnregisterWaitEx
FormatMessageW
GetProcessId
IsWow64Process
SetSystemTime
WaitForSingleObject
EndUpdateResourceA
GetProcessShutdownParameters
GetUserGeoID
GetModuleHandleA
GetTimeFormatW
CloseHandle
GetModuleFileNameA
GlobalDeleteAtom
Process32FirstW
GetEnvironmentStringsW

winspool.drv

AddMonitorW

comctl32

ImageList_AddMasked

netapi32

NetSessionGetInfo
NetGroupAddUser
NetLocalGroupAdd
NetLocalGroupAddMembers
NetSessionEnum

lz32

GetExpandedNameW
LZCopy

version

VerQueryValueW

rasapi32

RasGetSubEntryPropertiesA
RasGetCustomAuthDataW

wininet

InternetOpenUrlW
InternetCrackUrlA
ReadUrlCacheEntryStream

shell32

DuplicateIcon
SHGetFolderPathA
SHGetSpecialFolderPathA
SHEnumerateUnreadMailAccountsW
SHGetMalloc
Shell_NotifyIconW
DoEnvironmentSubstW

winscard

SCardReleaseContext
SCardSetCardTypeProviderNameW

imm32

ImmSetConversionStatus

oleaut32

SafeArrayLock
LoadTypeLibEx
BSTR_UserUnmarshal

secur32

QueryContextAttributesW
GetUserNameExA
ImpersonateSecurityContext
SetContextAttributesW

mprapi

MprInfoBlockAdd
MprConfigGetGuidName
MprAdminServerConnect
MprAdminMIBEntryGetFirst
MprAdminInterfaceConnect

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 960KB - Virtual size: 958KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c11e385a6629e17d66fd5bee13c089

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

esent

wintrust

opengl32

crypt32

shlwapi

user32

rpcrt4

msvfw32

ole32

clusapi

msacm32

msvcrt

ws2_32

winmm

setupapi

urlmon

mscms

advapi32

kernel32

winspool.drv

comctl32

netapi32

lz32

version

rasapi32

wininet

shell32

winscard

imm32

oleaut32

secur32

mprapi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.qdata Size: 960KB - Virtual size: 958KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 116KB - Virtual size: 116KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 52KB - Virtual size: 48KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.qdata
Size: 960KB - Virtual size: 958KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 116KB - Virtual size: 116KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 52KB - Virtual size: 48KB