af77069500c2cc59e75a58b88dc40557bef447ca510eab8d8b9530c1c29689c9

Sharing

Copy URL Twitter E-mail

General

Target

af77069500c2cc59e75a58b88dc40557bef447ca510eab8d8b9530c1c29689c9
Size

2.3MB
MD5

faea5e754dc4960fbd3b53510c86fb38
SHA1

3b49224c4c3f36d96c33e3a2257f8a0abc2391b5
SHA256

af77069500c2cc59e75a58b88dc40557bef447ca510eab8d8b9530c1c29689c9
SHA512

159005f0be13e1cb53947aa276c1f5554bd9ea6313d63912c481cd8a6d4b9eba61375da68391875f1a87b7e8732fd09d3820d9d239d6f50ed8fdb8e0e1552f37
SSDEEP

49152:4g9rtk76+oC4c9oHWgO8YyVOOUE/wFgtL1e9oPSyEuOBOILKtSb:Lpk7xP9o2d/E/igBsGSJOILUS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af77069500c2cc59e75a58b88dc40557bef447ca510eab8d8b9530c1c29689c9

Files

af77069500c2cc59e75a58b88dc40557bef447ca510eab8d8b9530c1c29689c9
.dll windows:5 windows x86 arch:x86

90ac12a9ce9752f62000c80da3fd8736

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msacm32

acmDriverDetailsW

imm32

ImmRegisterWordW

mscms

GetStandardColorSpaceProfileW
CloseColorProfile

mprapi

MprConfigInterfaceGetHandle
MprAdminMIBEntryDelete
MprConfigInterfaceEnum
MprAdminInterfaceGetInfo

winscard

SCardLocateCardsW
SCardEndTransaction
SCardConnectW

esent

JetSetIndexRange
JetRollback

ole32

CoCreateGuid
HPALETTE_UserMarshal
StgCreateStorageEx
HWND_UserMarshal
HBITMAP_UserSize
CoGetCurrentLogicalThreadId
CoQueryClientBlanket

kernel32

lstrcmpW
CommConfigDialogA
SetThreadPriority
WriteConsoleInputW
SwitchToThread
GetTimeFormatW
GetModuleHandleA
CloseHandle
SetThreadExecutionState
ClearCommBreak
GetUserDefaultUILanguage
GetStdHandle
HeapLock
Process32FirstW
VerLanguageNameA
SetSystemTime
EnterCriticalSection
EndUpdateResourceA
VirtualAlloc
GetSystemTimeAsFileTime
SetThreadLocale
IsBadStringPtrW
FindFirstFileExA
ReleaseSemaphore
VerSetConditionMask
WaitForSingleObject
WaitForSingleObjectEx
TerminateProcess
SetStdHandle
MoveFileWithProgressW
DeleteCriticalSection
WriteProcessMemory
ReadConsoleA
GetModuleFileNameA
GetProfileIntW

shlwapi

SHSkipJunction
StrStrW
StrStrA
StrChrA
PathMatchSpecW
SHIsLowMemoryMachine

winmm

midiStreamProperty
waveOutGetDevCapsW
mmioFlush
GetDriverModuleHandle
waveInOpen
midiOutUnprepareHeader
waveOutWrite
midiInOpen
midiOutShortMsg

comctl32

DestroyPropertySheetPage

oleaut32

LoadTypeLibEx
VarI2FromDate
VariantChangeTypeEx

setupapi

SetupDiEnumDeviceInfo
SetupLogErrorA
CM_Free_Resource_Conflict_Handle
CM_Open_DevNode_Key
SetupDiDestroyClassImageList
SetupGetBackupInformationW
CM_Get_DevNode_Registry_Property_ExW
SetupGetStringFieldW
CM_Get_Sibling_Ex
SetupDiDestroyDeviceInfoList
SetupDiGetClassDescriptionExA
SetupDiSetDeviceInstallParamsA

gdi32

GetTextCharacterExtra
GetWindowOrgEx
SetBitmapBits
FillPath
StretchBlt
LPtoDP
GetStretchBltMode
IntersectClipRect
Polyline
CloseEnhMetaFile
SetStretchBltMode
PathToRegion
GetCurrentObject
GetAspectRatioFilterEx
CreatePatternBrush
PolyPolyline
GetDeviceCaps
GetTextColor
AddFontResourceW

netapi32

NetLocalGroupEnum
NetUserChangePassword
NetShareSetInfo
NetApiBufferSize
NetServerComputerNameDel

opengl32

glGetError

advapi32

AreAnyAccessesGranted
CryptDuplicateHash
DeleteService
StartServiceCtrlDispatcherW
SetNamedSecurityInfoA
CryptSetHashParam
CreateProcessAsUserA
InitiateSystemShutdownA
RegCloseKey
SaferIdentifyLevel
InitializeSid
MapGenericMask
ChangeServiceConfig2W
RegOpenKeyW
AccessCheck
OpenBackupEventLogA
GetFileSecurityW
AddAccessDeniedAce

clusapi

ClusterRegCreateKey
ClusterRegQueryValue

secur32

AcquireCredentialsHandleA
ImpersonateSecurityContext
DeleteSecurityContext
GetUserNameExA

msvfw32

ICInstall

wininet

GetUrlCacheEntryInfoW
RetrieveUrlCacheEntryStreamA
InternetCombineUrlA

urlmon

CoGetClassObjectFromURL

rasapi32

RasRenameEntryW
RasGetAutodialAddressA

shell32

SHChangeNotify
SHGetFolderLocation
ExtractAssociatedIconExW
SHGetSpecialFolderPathA
SHAppBarMessage
SHGetInstanceExplorer
SHGetSpecialFolderPathW

rpcrt4

IUnknown_AddRef_Proxy
I_RpcServerInqLocalConnAddress
RpcEpUnregister
IUnknown_Release_Proxy
RpcStringFreeA

winspool.drv

ClosePrinter

ws2_32

select

lz32

LZInit
GetExpandedNameW
LZOpenFileW

msvcrt

fgets
iswxdigit
wcscoll
putc
wcslen

wintrust

CryptCATClose
WintrustAddActionID
WTHelperGetProvCertFromChain
WTHelperCertIsSelfSigned
CryptSIPRemoveSignedDataMsg
CryptCATPersistStore
CryptCATCatalogInfoFromContext

crypt32

CryptImportPublicKeyInfo
CertAddCRLContextToStore
CertSetEnhancedKeyUsage

version

GetFileVersionInfoSizeA

user32

MonitorFromRect
mouse_event
FillRect
SetScrollRange
SetScrollInfo
AttachThreadInput
ImpersonateDdeClientWindow
ChildWindowFromPointEx
LoadImageA
WinHelpW
GetIconInfo
GetClientRect
MessageBeep
GetFocus
DestroyIcon
GetAsyncKeyState
CreateAcceleratorTableA
CreateWindowExA
GetUpdateRgn
CharNextW
SetMenu
AdjustWindowRectEx
ShowWindow
DragDetect
GetTopWindow
GetClassLongA
InSendMessageEx
UpdateWindow
OffsetRect
ShowOwnedPopups

Exports

Exports

EhckewmiraarldeQnd

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt0
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90ac12a9ce9752f62000c80da3fd8736

Headers

DLL Characteristics

File Characteristics

Imports

msacm32

imm32

mscms

mprapi

winscard

esent

ole32

kernel32

shlwapi

winmm

comctl32

oleaut32

setupapi

gdi32

netapi32

opengl32

advapi32

clusapi

secur32

msvfw32

wininet

urlmon

rasapi32

shell32

rpcrt4

winspool.drv

ws2_32

lz32

msvcrt

wintrust

crypt32

version

user32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.crt0 Size: 8KB - Virtual size: 4KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 208KB - Virtual size: 205KB

.rdata Size: 4KB - Virtual size: 896B

.reloc Size: 84KB - Virtual size: 80KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.crt0
Size: 8KB - Virtual size: 4KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 208KB - Virtual size: 205KB

.rdata
Size: 4KB - Virtual size: 896B

.reloc
Size: 84KB - Virtual size: 80KB