d892cf8fb1a9f61393b6ac8fc0a8651daebc73ee044342c6ca30fcaab5f4111c

Sharing

Copy URL Twitter E-mail

General

Target

d892cf8fb1a9f61393b6ac8fc0a8651daebc73ee044342c6ca30fcaab5f4111c
Size

2.5MB
MD5

94d9185e1089e552cbf3cd7b9ff95367
SHA1

35872ee31d410c8d087588ec064be3290c5a4ad2
SHA256

d892cf8fb1a9f61393b6ac8fc0a8651daebc73ee044342c6ca30fcaab5f4111c
SHA512

b723dcf745e127e3d92d0ae56ccda0fbff3621172d77220d8177bc3fabea0d0b5541378c92784ebbeae1a8f16deaf0295b2cf10b13bdcabfc60ebf0cc1363f7f
SSDEEP

49152:p99L0pHi5HU26/xMDucf4fm5MqhpowDIm6rIZCNFFmM:p99YpHii2wuDuPfkOwtgNFE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d892cf8fb1a9f61393b6ac8fc0a8651daebc73ee044342c6ca30fcaab5f4111c

Files

d892cf8fb1a9f61393b6ac8fc0a8651daebc73ee044342c6ca30fcaab5f4111c
.dll windows:5 windows x86 arch:x86

fe1d8757908bd20f54ce4e62d65e8950

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wintrust

WintrustAddActionID
CryptCATPersistStore
CryptCATClose
CryptCATCatalogInfoFromContext
WTHelperGetProvCertFromChain
WTHelperCertIsSelfSigned
CryptSIPRemoveSignedDataMsg

mprapi

MprInfoBlockSet
MprConfigInterfaceEnum
MprAdminServerConnect
MprAdminInterfaceGetInfo
MprConfigInterfaceGetHandle

msvcrt

iswxdigit
wcslen
wcscoll
putc
fgets

lz32

GetExpandedNameW
LZInit
LZOpenFileW

advapi32

RegCloseKey
CreateProcessAsUserA
InitializeSid
DeleteService
StartServiceCtrlDispatcherW
OpenBackupEventLogA
GetFileSecurityW
CryptDuplicateHash
AddAccessDeniedAce
InitiateSystemShutdownA
AccessCheck
CryptSetHashParam
AreAnyAccessesGranted
SetNamedSecurityInfoA
RegOpenKeyW
MapGenericMask
ChangeServiceConfig2W
SaferIdentifyLevel

user32

AttachThreadInput
mouse_event
CharNextW
CreateWindowExA
GetClassLongA
AdjustWindowRectEx
UpdateWindow
ChildWindowFromPointEx
WinHelpW
DragDetect
GetPriorityClipboardFormat
GetUpdateRgn
CreateAcceleratorTableA
ShowOwnedPopups
DestroyIcon
GetFocus
MessageBeep
GetClientRect
GetIconInfo
ExitWindowsEx
InSendMessageEx
SetScrollInfo
GetTopWindow
MonitorFromRect
ExcludeUpdateRgn
FillRect
SetMenu
CheckRadioButton
ImpersonateDdeClientWindow
ShowWindow

opengl32

glGetError

comctl32

DestroyPropertySheetPage

rasapi32

RasGetAutodialAddressA
RasRenameEntryW

shell32

SHGetSpecialFolderPathW
SHGetFolderLocation
SHFileOperationA
SHChangeNotify
ExtractAssociatedIconExW
SHGetSpecialFolderPathA
SHGetInstanceExplorer
FindExecutableA

version

GetFileVersionInfoSizeA

msvfw32

ICInstall

oleaut32

VarI2FromDate
VariantChangeTypeEx
LoadTypeLibEx

secur32

GetUserNameExA
GetComputerObjectNameW
AcquireCredentialsHandleA
DeleteSecurityContext

winmm

mmioFlush
midiInOpen
waveOutWrite
waveOutGetDevCapsW
midiOutUnprepareHeader
midiStreamProperty
midiOutShortMsg
GetDriverModuleHandle
waveInOpen

setupapi

SetupGetStringFieldW
CM_Open_DevNode_Key
SetupDiGetClassDescriptionExA
SetupDiChangeState
CM_Get_DevNode_Registry_Property_ExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Free_Resource_Conflict_Handle
SetupDiDestroyClassImageList
SetupDiSetDeviceInstallParamsA
SetupDiGetClassDevsW
SetupGetBackupInformationW

netapi32

NetLocalGroupDel
NetShareSetInfo
NetSessionDel
NetUserChangePassword
NetShareCheck

winspool.drv

ClosePrinter

urlmon

URLOpenBlockingStreamW

clusapi

ClusterRegQueryValue
ClusterRegCreateKey

shlwapi

PathMatchSpecW
StrChrA
SHRegGetValueA
SHIsLowMemoryMachine
StrStrA
StrStrW

rpcrt4

NdrDcomAsyncClientCall
I_RpcServerInqLocalConnAddress
RpcEpUnregister
UuidToStringA
IUnknown_Release_Proxy

crypt32

CertEnumCertificatesInStore
CertAddCRLContextToStore
CryptImportPublicKeyInfo

msacm32

acmDriverDetailsW

imm32

ImmNotifyIME

ws2_32

select

esent

JetSetIndexRange
JetRollback

kernel32

ClearCommBreak
GetStdHandle
HeapLock
EnterCriticalSection
SetProcessAffinityMask
VerLanguageNameA
CommConfigDialogA
ReleaseSemaphore
TerminateProcess
SetStdHandle
Process32FirstW
SetThreadLocale
GetSystemTimeAsFileTime
FindFirstFileExA
MoveFileWithProgressW
SetThreadExecutionState
EndUpdateResourceA
WriteProcessMemory
SetSystemTime
ReadConsoleA
WaitForSingleObjectEx
GetModuleFileNameA
IsBadStringPtrW
VirtualAlloc
DeleteCriticalSection
VerSetConditionMask
lstrcmpW
GetModuleHandleA
GetDiskFreeSpaceA
WaitForSingleObject
GetProfileIntW
CloseHandle
SetThreadPriority
GetTimeFormatW
GetUserDefaultUILanguage

gdi32

GetAspectRatioFilterEx
FillPath
GetTextCharacterExtra
EnumMetaFile
GetStretchBltMode
LPtoDP
SetDIBitsToDevice
Polyline
PolyPolyline
CloseEnhMetaFile
GetWindowOrgEx
IntersectClipRect
StretchBlt
SetStretchBltMode
CreatePatternBrush
PathToRegion
SetBitmapBits
GetTextColor
GetDeviceCaps

ole32

WriteClassStm
HPALETTE_UserMarshal
CoGetInterfaceAndReleaseStream
CoQueryClientBlanket
HBITMAP_UserSize
GetRunningObjectTable
StgCreateStorageEx

mscms

CloseColorProfile

wininet

GetUrlCacheEntryInfoW
InternetCombineUrlA
RetrieveUrlCacheEntryStreamA

winscard

g_rgSCardT1Pci
SCardEndTransaction
SCardLocateCardsW

Exports

Exports

EhckewmiraarldeQnd

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt0
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe1d8757908bd20f54ce4e62d65e8950

Headers

DLL Characteristics

File Characteristics

Imports

wintrust

mprapi

msvcrt

lz32

advapi32

user32

opengl32

comctl32

rasapi32

shell32

version

msvfw32

oleaut32

secur32

winmm

setupapi

netapi32

winspool.drv

urlmon

clusapi

shlwapi

rpcrt4

crypt32

msacm32

imm32

ws2_32

esent

kernel32

gdi32

ole32

mscms

wininet

winscard

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.crt0 Size: 8KB - Virtual size: 4KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 84KB - Virtual size: 82KB

.rsrc Size: 4KB - Virtual size: 896B

.reloc Size: 40KB - Virtual size: 36KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.crt0
Size: 8KB - Virtual size: 4KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 84KB - Virtual size: 82KB

.rsrc
Size: 4KB - Virtual size: 896B

.reloc
Size: 40KB - Virtual size: 36KB