56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5

Sharing

Copy URL Twitter E-mail

General

Target
56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5
Size 609KB
Sample240727-2d9m4avenc
SHA256 56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5
MD5 1c5f89f15a44a8eb23f27eb9bb28119c
SHA1 79768cd8228e799914209dc15d79009794f53300
SHA512 8ed2f18e9b30b7f28987f6ad4ea218c5839f7b986585e21f9860f53d6a737a01b30f15e66dd061fddc19ddbc2d93dce0370546e399dd5ec6b1af42d58dc8c7a1
SSDEEP 12288:1wlhC3yPjbkgkWedvdq7C+Ww0BrwiEdfjFb1WXK1/mt:2CCPjsWe27zd0BrwiEZbN1i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5

File Explorer

56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5

.dll 609KB

56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5

IMPHASH 5d43f4933bfc2d50b9ecf81a4e9c29f4
SHA256 56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5
MD5 1c5f89f15a44a8eb23f27eb9bb28119c
SHA1 79768cd8228e799914209dc15d79009794f53300
SHA512 8ed2f18e9b30b7f28987f6ad4ea218c5839f7b986585e21f9860f53d6a737a01b30f15e66dd061fddc19ddbc2d93dce0370546e399dd5ec6b1af42d58dc8c7a1
SSDEEP 12288:1wlhC3yPjbkgkWedvdq7C+Ww0BrwiEdfjFb1WXK1/mt:2CCPjsWe27zd0BrwiEZbN1i
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dnsapi.pdb

api-ms-win-core-crt-l1-1-0

atoi _strlwr_s _strupr_s _vsnprintf_s strncmp strtoul memcmp memcpy towlower wcschr wcstoul _stricmp _strnicmp _wcsicmp _wcsnicmp wcspbrk _vsnwprintf_s __C_specific_handler memset

api-ms-win-core-crt-l2-1-0

_initterm_e _initterm time

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter UnhandledExceptionFilter SetLastError GetLastError

api-ms-win-core-file-l1-2-0

ReadFile SetFilePointer CreateFileA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap HeapFree

api-ms-win-core-libraryloader-l1-1-1

GetModuleFileNameW LoadLibraryExA LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleHandleExW FreeLibrary DisableThreadLibraryCalls

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegCloseKey RegDeleteKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegEnumKeyExW RegGetValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalReAlloc LocalAlloc LocalFree

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-1

CreateThread GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-core-sysinfo-l1-2-0

GetSystemDirectoryA GetVersionExW GetTickCount GetSystemTimeAsFileTime GetTickCount64

api-ms-win-core-synch-l1-2-0

CreateEventA ReleaseMutex LeaveCriticalSection EnterCriticalSection SetEvent CreateSemaphoreExW WaitForSingleObject ReleaseSemaphore WaitForMultipleObjectsEx ResetEvent InitializeCriticalSection Sleep AcquireSRWLockExclusive CreateEventW ReleaseSRWLockExclusive InitializeSRWLock AcquireSRWLockShared ReleaseSRWLockShared DeleteCriticalSection

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolIo WaitForThreadpoolIoCallbacks CreateThreadpoolIo WaitForThreadpoolTimerCallbacks SubmitThreadpoolWork CreateThreadpoolWork StartThreadpoolIo CancelThreadpoolIo DisassociateCurrentThreadFromCallback CloseThreadpoolTimer CloseThreadpoolWork

ws2_32

socket closesocket htons htonl send WSAGetLastError sendto __WSAFDIsSet getservbyport getprotobynumber getprotobyname FreeAddrInfoW select WSAIoctl connect WSARecv getsockname setsockopt WSASocketW listen shutdown WSAJoinLeaf bind GetAddrInfoW ntohs inet_ntoa WSACleanup inet_addr ntohl WSAStartup

ntdll

NtCreateFile NtCancelIoFile NtDeviceIoControlFile WinSqmAddToStream EtwEventUnregister EtwEventRegister EtwUnregisterTraceGuids EtwEventEnabled EtwEventWrite EtwEventActivityIdControl EtwLogTraceEvent RtlInitUnicodeString WinSqmIsOptedIn RtlIpv4StringToAddressW EtwRegisterTraceGuidsW EtwGetTraceEnableFlags EtwGetTraceEnableLevel WinSqmSetDWORD RtlCaptureContext RtlStringFromGUID RtlFreeUnicodeString RtlIpv6StringToAddressA RtlIpv4StringToAddressA RtlIpv6AddressToStringA RtlIpv6StringToAddressExW RtlIdnToUnicode RtlIdnToAscii RtlIdnToNameprepUnicode RtlAllocateHeap RtlReAllocateHeap RtlFreeHeap RtlVirtualUnwind RtlLookupFunctionEntry EtwGetTraceLoggerHandle RtlInitializeCriticalSection EtwTraceMessage RtlIpv6StringToAddressW

nsi

NsiFreeTable NsiGetParameter NsiAllocateAndGetTable NsiGetAllParameters

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime FileTimeToSystemTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI DelayLoadFailureHook

AddRefQueryBlobEx BreakRecordsIntoBlob CombineRecordsInBlob DeRefQueryBlobEx DelaySortDAServerlist DnsAcquireContextHandle_A DnsAcquireContextHandle_W DnsAllocateRecord DnsApiAlloc DnsApiAllocZero DnsApiFree DnsApiHeapReset DnsApiRealloc DnsApiSetDebugGlobals DnsAsyncRegisterHostAddrs DnsAsyncRegisterInit DnsAsyncRegisterTerm DnsCancelQuery DnsCopyStringEx DnsCreateReverseNameStringForIpAddress DnsCreateStandardDnsNameCopy DnsCreateStringCopy DnsDhcpRegisterAddrs DnsDhcpRegisterHostAddrs DnsDhcpRegisterInit DnsDhcpRegisterTerm DnsDhcpRemoveRegistrations DnsDhcpSrvRegisterHostAddr DnsDhcpSrvRegisterHostAddrEx DnsDhcpSrvRegisterHostName DnsDhcpSrvRegisterHostNameEx DnsDhcpSrvRegisterInit DnsDhcpSrvRegisterInitialize DnsDhcpSrvRegisterTerm DnsDisableIdnEncoding DnsDowncaseDnsNameLabel DnsExtractRecordsFromMessage_UTF8 DnsExtractRecordsFromMessage_W DnsFindAuthoritativeZone DnsFlushResolverCache DnsFlushResolverCacheEntry_A DnsFlushResolverCacheEntry_UTF8 DnsFlushResolverCacheEntry_W DnsFree DnsFreeConfigStructure DnsFreePolicyConfig DnsFreeProxyName DnsGetBufferLengthForStringCopy DnsGetCacheDataTable DnsGetDnsServerList DnsGetDomainName DnsGetLastFailedUpdateInfo DnsGetPolicyTableInfo DnsGetPolicyTableInfoPrivate DnsGetPrimaryDomainName_A DnsGetProxyInfoPrivate DnsGetProxyInformation DnsGlobals DnsIpv6AddressToString DnsIpv6StringToAddress DnsIsAMailboxType DnsIsNSECType DnsIsStatusRcode DnsIsStringCountValidForTextType DnsLogEvent DnsMapRcodeToStatus DnsModifyRecordsInSet_A DnsModifyRecordsInSet_UTF8 DnsModifyRecordsInSet_W DnsNameCompareEx_A DnsNameCompareEx_UTF8 DnsNameCompareEx_W DnsNameCompare_A DnsNameCompare_UTF8 DnsNameCompare_W DnsNameCopy DnsNameCopyAllocate DnsNetworkInfo_CreateFromFAZ DnsNetworkInformation_CreateFromFAZ DnsNotifyResolver DnsNotifyResolverClusterIp DnsNotifyResolverEx DnsQueryConfig DnsQueryConfigAllocEx DnsQueryConfigDword DnsQueryEx DnsQueryExA DnsQueryExUTF8 DnsQueryExW DnsQuery_A DnsQuery_UTF8 DnsQuery_W DnsRecordBuild_UTF8 DnsRecordBuild_W DnsRecordCompare DnsRecordCopyEx DnsRecordListFree DnsRecordSetCompare DnsRecordSetCopyEx DnsRecordSetDetach DnsRecordStringForType DnsRecordStringForWritableType DnsRecordTypeForName DnsReleaseContextHandle DnsRemoveRegistrations DnsReplaceRecordSetA DnsReplaceRecordSetUTF8 DnsReplaceRecordSetW DnsResolverOp DnsScreenLocalAddrsForRegistration DnsSetConfigDword DnsStatusString DnsStringCopyAllocateEx DnsTraceServerConfig DnsUnicodeToUtf8 DnsUpdate DnsUpdateMachinePresence DnsUpdateTest_A DnsUpdateTest_UTF8 DnsUpdateTest_W DnsUtf8ToUnicode DnsValidateNameOrIp_TempW DnsValidateName_A DnsValidateName_UTF8 DnsValidateName_W DnsValidateServerArray_A DnsValidateServerArray_W DnsValidateServerStatus DnsValidateServer_A DnsValidateServer_W DnsValidateUtf8Byte DnsWriteQuestionToBuffer_UTF8 DnsWriteQuestionToBuffer_W DnsWriteReverseNameStringForIpAddress Dns_AddRecordsToMessage Dns_AllocateMsgBuf Dns_BuildPacket Dns_CacheServiceCleanup Dns_CacheServiceInit Dns_CleanupWinsock Dns_CloseConnection Dns_CloseSocket Dns_CreateMulticastSocket Dns_CreateSocket Dns_CreateSocketEx Dns_ExtractRecordsFromMessage Dns_FindAuthoritativeZoneLib Dns_FreeMsgBuf Dns_GetRandomXid Dns_InitializeMsgBuf Dns_InitializeMsgRemoteSockaddr Dns_InitializeWinsock Dns_OpenTcpConnectionAndSend Dns_ParseMessage Dns_ParsePacketRecord Dns_PingAdapterServers Dns_ReadPacketName Dns_ReadPacketNameAllocate Dns_ReadRecordStructureFromPacket Dns_RecvTcp Dns_ResetNetworkInfo Dns_SendAndRecvUdp Dns_SendEx Dns_SetRecordDatalength Dns_SetRecordsSection Dns_SetRecordsTtl Dns_SkipPacketName Dns_SkipToRecord Dns_UpdateLib Dns_UpdateLibEx Dns_WriteDottedNameToPacket Dns_WriteQuestionToMessage Dns_WriteRecordStructureToPacketEx ExtraInfo_Init Faz_AreServerListsInSameNameSpace FlushDnsPolicyUnreachableStatus GetCurrentTimeInSeconds HostsFile_Close HostsFile_Open HostsFile_ReadLine IpHelp_IsAddrOnLink Local_GetRecordsForLocalName Local_GetRecordsForLocalNameEx NetInfo_Build NetInfo_Clean NetInfo_Copy NetInfo_CreatePerNetworkNetinfo NetInfo_Free NetInfo_GetAdapterByAddress NetInfo_GetAdapterByInterfaceIndex NetInfo_GetAdapterByName NetInfo_IsAddrConfig NetInfo_IsForUpdate NetInfo_ResetServerPriorities NetInfo_UpdateNetworkProperties NetInfo_UpdateServerReachability QueryDirectEx Query_Cancel Query_Main Reg_FreeUpdateInfo Reg_GetValueEx Reg_ReadGlobalsEx Reg_ReadUpdateInfo Security_ContextListTimeout Send_AndRecvUdpWithParam Send_MessagePrivate Send_OpenTcpConnectionAndSend Socket_CacheCleanup Socket_CacheInit Socket_CleanupWinsock Socket_ClearMessageSockets Socket_CloseEx Socket_CloseMessageSockets Socket_Create Socket_CreateMulticast Socket_InitWinsock Socket_JoinMulticast Socket_RecvFrom Socket_SetMulticastInterface Socket_SetMulticastLoopBack Socket_SetTtl Socket_TcpListen Trace_Reset Update_ReplaceAddressRecordsW Util_IsIp6Running

Sharing

General

Malware Config

Signatures

File Explorer

56b13cd7f3e823781a65dd723d6a3ece9720c5e0a8c1f1d5f7ad080ba0ac7fc5

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ws2_32

ntdll

nsi

api-ms-win-core-debug-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

generic