d1b46dda42028a88d8e4213024b3ab798f254e29327ce0fd74f327256601cfba

Sharing

Copy URL Twitter E-mail

General

Target

d1b46dda42028a88d8e4213024b3ab798f254e29327ce0fd74f327256601cfba
Size

8.9MB
MD5

b323de1c505d5e80a5c861719debcd05
SHA1

2c915f20aca068e3361b71e75f546c954cebe2ee
SHA256

d1b46dda42028a88d8e4213024b3ab798f254e29327ce0fd74f327256601cfba
SHA512

33bcdf4821894243ea1ab2761a8787d7e538031426738f4e9a75507310281641675a8c7ffa4857aa824fce4489d103af13c0d9cbbf2fe60e2ab7b3b74a26e6bb
SSDEEP

196608:zhcCKfw/K1utMK8PTspK79MmdTlGXIIyq5ZXtxaUcDuSIA:FMz0tnmJ8r5Zdxaru+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1b46dda42028a88d8e4213024b3ab798f254e29327ce0fd74f327256601cfba

Files

d1b46dda42028a88d8e4213024b3ab798f254e29327ce0fd74f327256601cfba
.dll windows:6 windows x64 arch:x64

b722e0ec193df6b12c8639b6b16438a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

FindWindowExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

CryptGetProvParam

shell32

ord680

ole32

CreateStreamOnHGlobal

oleaut32

SafeArrayGetLBound

ws2_32

closesocket

shlwapi

PathCombineW

wintrust

WinVerifyTrust

ntdll

RtlVirtualUnwind

rpcrt4

RpcServerUnregisterIf

dbghelp

ImageDirectoryEntryToData

mpr

WNetGetProviderNameW

iphlpapi

GetNetworkParams

setupapi

SetupDiGetClassDevsW

bcrypt

BCryptGenRandom

gdiplus

GdipGetImageWidth

gdi32

BitBlt

crypt32

CertGetCertificateContextProperty

psapi

GetModuleFileNameExW

wtsapi32

WTSSendMessageW

Exports

Exports

NEP_StartScan

Sections

.text
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 929KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ndata1
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ndata0
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.200
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.201
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b722e0ec193df6b12c8639b6b16438a2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

ntdll

rpcrt4

dbghelp

mpr

iphlpapi

setupapi

bcrypt

gdiplus

gdi32

crypt32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 3.4MB

.rdata Size: - Virtual size: 929KB

.data Size: - Virtual size: 195KB

.pdata Size: - Virtual size: 146KB

.ndata1 Size: - Virtual size: 8KB

.ndata0 Size: - Virtual size: 24B

_RDATA Size: - Virtual size: 384B

.200 Size: - Virtual size: 3.3MB

.201 Size: 8.9MB - Virtual size: 8.9MB

.reloc Size: 512B - Virtual size: 224B

.rsrc Size: 1024B - Virtual size: 2.6MB

.text
Size: - Virtual size: 3.4MB

.rdata
Size: - Virtual size: 929KB

.data
Size: - Virtual size: 195KB

.pdata
Size: - Virtual size: 146KB

.ndata1
Size: - Virtual size: 8KB

.ndata0
Size: - Virtual size: 24B

_RDATA
Size: - Virtual size: 384B

.200
Size: - Virtual size: 3.3MB

.201
Size: 8.9MB - Virtual size: 8.9MB

.reloc
Size: 512B - Virtual size: 224B

.rsrc
Size: 1024B - Virtual size: 2.6MB