20a17e69c72601edc441b265f70bec3fc815eaba9a0e825b8d53f2a56ae16c92

Sharing

Copy URL

Twitter E-mail

General

Target

20a17e69c72601edc441b265f70bec3fc815eaba9a0e825b8d53f2a56ae16c92
Size

2.5MB
MD5

6a23d890bb0be2f90140af407040fa12
SHA1

1a9f2aa01c745125ddebed4bdfd8c37abfc4063a
SHA256

20a17e69c72601edc441b265f70bec3fc815eaba9a0e825b8d53f2a56ae16c92
SHA512

062fc7d21a4587faf132cb84e9c887033002a1736a8b4fa9a459e9fdbcc7cd76ad38868024f03c71781c830fc2ad1670274e2d3277c5cbf504ce97e20f4499c2
SSDEEP

49152:/99L0pHi5HU26/xMDucf4fm5MqhpowDIm6rIZCNFFmX:/99YpHii2wuDuPfkOwtgNFE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20a17e69c72601edc441b265f70bec3fc815eaba9a0e825b8d53f2a56ae16c92

Files

20a17e69c72601edc441b265f70bec3fc815eaba9a0e825b8d53f2a56ae16c92
.dll windows:5 windows x86 arch:x86

f0a37aa09a1e2a358a9fbb55f8cb58b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wintrust

WintrustAddActionID
CryptCATPersistStore
CryptCATClose
CryptCATCatalogInfoFromContext
WTHelperGetProvCertFromChain
WTHelperCertIsSelfSigned
CryptSIPRemoveSignedDataMsg

gdi32

GetAspectRatioFilterEx
FillPath
GetTextCharacterExtra
EnumMetaFile
GetStretchBltMode
LPtoDP
SetDIBitsToDevice
Polyline
PolyPolyline
CloseEnhMetaFile
GetWindowOrgEx
IntersectClipRect
StretchBlt
SetStretchBltMode
CreatePatternBrush
PathToRegion
SetBitmapBits
GetTextColor
GetDeviceCaps

msvcrt

iswxdigit
wcslen
wcscoll
putc
fgets

lz32

GetExpandedNameW
LZInit
LZOpenFileW

mscms

CloseColorProfile

user32

AttachThreadInput
mouse_event
CharNextW
CreateWindowExA
GetClassLongA
AdjustWindowRectEx
UpdateWindow
ChildWindowFromPointEx
WinHelpW
DragDetect
GetPriorityClipboardFormat
GetUpdateRgn
CreateAcceleratorTableA
ShowOwnedPopups
DestroyIcon
GetFocus
MessageBeep
GetClientRect
GetIconInfo
ExitWindowsEx
InSendMessageEx
SetScrollInfo
GetTopWindow
MonitorFromRect
ExcludeUpdateRgn
FillRect
SetMenu
CheckRadioButton
ImpersonateDdeClientWindow
ShowWindow

opengl32

glGetError

comctl32

DestroyPropertySheetPage

rasapi32

RasGetAutodialAddressA
RasRenameEntryW

shell32

SHGetSpecialFolderPathW
SHGetFolderLocation
SHFileOperationA
SHChangeNotify
ExtractAssociatedIconExW
SHGetSpecialFolderPathA
SHGetInstanceExplorer
FindExecutableA

version

GetFileVersionInfoSizeA

msvfw32

ICInstall

oleaut32

VarI2FromDate
VariantChangeTypeEx
LoadTypeLibEx

secur32

GetUserNameExA
GetComputerObjectNameW
AcquireCredentialsHandleA
DeleteSecurityContext

winmm

mmioFlush
midiInOpen
waveOutWrite
waveOutGetDevCapsW
midiOutUnprepareHeader
midiStreamProperty
midiOutShortMsg
GetDriverModuleHandle
waveInOpen

setupapi

SetupGetStringFieldW
CM_Open_DevNode_Key
SetupDiGetClassDescriptionExA
SetupDiChangeState
CM_Get_DevNode_Registry_Property_ExW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Free_Resource_Conflict_Handle
SetupDiDestroyClassImageList
SetupDiSetDeviceInstallParamsA
SetupDiGetClassDevsW
SetupGetBackupInformationW

netapi32

NetLocalGroupDel
NetShareSetInfo
NetSessionDel
NetUserChangePassword
NetShareCheck

winspool.drv

ClosePrinter

urlmon

URLOpenBlockingStreamW

clusapi

ClusterRegQueryValue
ClusterRegCreateKey

shlwapi

PathMatchSpecW
StrChrA
SHRegGetValueA
SHIsLowMemoryMachine
StrStrA
StrStrW

rpcrt4

NdrDcomAsyncClientCall
I_RpcServerInqLocalConnAddress
RpcEpUnregister
UuidToStringA
IUnknown_Release_Proxy

crypt32

CertEnumCertificatesInStore
CertAddCRLContextToStore
CryptImportPublicKeyInfo

msacm32

acmDriverDetailsW

imm32

ImmNotifyIME

ws2_32

select

esent

JetSetIndexRange
JetRollback

kernel32

ClearCommBreak
GetStdHandle
HeapLock
EnterCriticalSection
SetProcessAffinityMask
VerLanguageNameA
CommConfigDialogA
ReleaseSemaphore
TerminateProcess
SetStdHandle
Process32FirstW
SetThreadLocale
GetSystemTimeAsFileTime
FindFirstFileExA
MoveFileWithProgressW
SetThreadExecutionState
EndUpdateResourceA
WriteProcessMemory
SetSystemTime
ReadConsoleA
WaitForSingleObjectEx
GetModuleFileNameA
IsBadStringPtrW
VirtualAlloc
DeleteCriticalSection
VerSetConditionMask
lstrcmpW
GetModuleHandleA
GetDiskFreeSpaceA
WaitForSingleObject
GetProfileIntW
CloseHandle
SetThreadPriority
GetTimeFormatW
GetUserDefaultUILanguage

mprapi

MprInfoBlockSet
MprConfigInterfaceEnum
MprAdminServerConnect
MprAdminInterfaceGetInfo
MprConfigInterfaceGetHandle

ole32

WriteClassStm
HPALETTE_UserMarshal
CoGetInterfaceAndReleaseStream
CoQueryClientBlanket
HBITMAP_UserSize
GetRunningObjectTable
StgCreateStorageEx

advapi32

RegCloseKey
CreateProcessAsUserA
InitializeSid
DeleteService
StartServiceCtrlDispatcherW
OpenBackupEventLogA
GetFileSecurityW
CryptDuplicateHash
AddAccessDeniedAce
InitiateSystemShutdownA
AccessCheck
CryptSetHashParam
AreAnyAccessesGranted
SetNamedSecurityInfoA
RegOpenKeyW
MapGenericMask
ChangeServiceConfig2W
SaferIdentifyLevel

wininet

GetUrlCacheEntryInfoW
InternetCombineUrlA
RetrieveUrlCacheEntryStreamA

winscard

g_rgSCardT1Pci
SCardEndTransaction
SCardLocateCardsW

Exports

Exports

EhckewmiraarldeQnd

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt0
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0a37aa09a1e2a358a9fbb55f8cb58b0

Headers

DLL Characteristics

File Characteristics

Imports

wintrust

gdi32

msvcrt

lz32

mscms

user32

opengl32

comctl32

rasapi32

shell32

version

msvfw32

oleaut32

secur32

winmm

setupapi

netapi32

winspool.drv

urlmon

clusapi

shlwapi

rpcrt4

crypt32

msacm32

imm32

ws2_32

esent

kernel32

mprapi

ole32

advapi32

wininet

winscard

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.crt0 Size: 8KB - Virtual size: 4KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 84KB - Virtual size: 82KB

.rsrc Size: 4KB - Virtual size: 896B

.reloc Size: 40KB - Virtual size: 36KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.crt0
Size: 8KB - Virtual size: 4KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 84KB - Virtual size: 82KB

.rsrc
Size: 4KB - Virtual size: 896B

.reloc
Size: 40KB - Virtual size: 36KB