fb0bdd9d17e6773c9ff5a717ad6b26383fe2c52b65ff615ea14df3d1764be1f6

Sharing

Copy URL Twitter E-mail

General

Target

fb0bdd9d17e6773c9ff5a717ad6b26383fe2c52b65ff615ea14df3d1764be1f6
Size

337KB
MD5

3dc973ff41bf214959b80f3bd1aa9293
SHA1

0925e6da42351179537d8ab574c99a31abc7e087
SHA256

fb0bdd9d17e6773c9ff5a717ad6b26383fe2c52b65ff615ea14df3d1764be1f6
SHA512

823776326d80c1146cad7bcc3bb1c7de13641d2c52f2a43fced9f19216d84f3f54a153a9399b0960b76748b99e37a328ebc0a754b66884ce51503cae4983e2d4
SSDEEP

6144:HSy5Xu/UcajTOouEb9nU4AOvDc6MyXyP4Jj:HzJu/ULjqY9nU45Dc6ryP4J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb0bdd9d17e6773c9ff5a717ad6b26383fe2c52b65ff615ea14df3d1764be1f6

Files

fb0bdd9d17e6773c9ff5a717ad6b26383fe2c52b65ff615ea14df3d1764be1f6
.dll windows:5 windows x86 arch:x86

7010eefb43374b611f4b57e2c78ab965

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

psapi

GetProcessImageFileNameA
EnumProcessModules

shlwapi

StrStrIW
StrCmpIW
StrTrimW
StrCatW
StrCmpW
StrRStrIW
StrCpyW
PathUnquoteSpacesW
PathRemoveArgsW
StrStrIA

kernel32

GetModuleHandleW
LoadLibraryA
lstrlenW
GetCommandLineW
GetCurrentProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
OutputDebugStringW
GetWindowsDirectoryW
OutputDebugStringA
FindFirstFileW
FindClose
LocalFree
GetTickCount
SetLastError
HeapLock
HeapWalk
GetLastError
GetProcessHeaps
HeapUnlock
VirtualQuery
VirtualFree
TerminateThread
CloseHandle
FreeLibrary
CreateEventA
GetModuleFileNameA
VirtualProtect
GetProcAddress
WaitForSingleObject
ResumeThread
GetModuleHandleA
Sleep
SetEvent
GetVersionExA
GetSystemInfo
GetComputerNameW
GetProcessId
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
ReadFile
CreateFileA
GetCurrentProcessId
lstrcmpiA
Process32First
OpenProcess
CreateToolhelp32Snapshot
FileTimeToSystemTime
Process32Next
GetSystemTime
GetProcessTimes
GetFileAttributesExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetEnvironmentVariableW
GetProcessHeap
HeapSize
SetStdHandle
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
CreateFileW
WriteConsoleW
VirtualAlloc
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapReAlloc
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW

advapi32

RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

CommandLineToArgvW

dbghelp

ImageNtHeader

ws2_32

ntohs
inet_addr

Exports

Exports

Amsi_VirtualProtect_Enter_Handler
CElement_mergeAttribute_Enter_Handler
CInput_createTextRange_Enter_Handler
CLSIDFromProgID_Enter_Handler
COMSafety_CoGetClassObject_Exit_Handler
COMSafety_CoInitializeEx_Exit_Handler
COMSafety_CoInitialize_Exit_Handler
CObjectElement_put_classid_Enter_Handler
CTORCH_CLSIDFromProgID_Enter_Handler
CTORCH_CreateProcessInternalW_Enter_Handler
ChangedSubscription_Enter_Handler
CoCreateInstanceEx_Enter_Handler
CoGetClassObjectFromURL_Enter_Handler
CoGetClassObject_Enter_Handler
CoInternetParseUrlIE_Exit_Handler
CompatFlagsFromClsid_Enter_Handler
CopyMediaType_Enter_Handler
CopyUrlForParser_Enter_Handler
CreateProcessW_Enter_Handler
CreateProcessW_Enter_Handler_CVE_2007_3896
CreateProcessW_Enter_Handler_CVE_2014_4114
CreateProcessW_Enter_Handler_URI_Injection
CreateUri_Enter_Handler
CryptAcquireContext_Enter_Handler
CryptEncrypt_Enter_Handler
CryptGenRandom_Enter_Handler
DpAPI_CryptUnprotectData_Exit_Handler
Excel_Macro_QueueUserAPC_Enter_Handler
Excel_Macro_VirtualAlloc_Exit_Handler
FindFirstFileW_Exit_Handler
FindNextFileW1_Enter_Handler
GetAsyncKeyState_Enter_Handler
GetSystemTimeAsFileTime2_Enter_Handler
GetSystemTimeAsFileTime_Mimikatz_Enter_Handler
GetSystemTimeAsFileTime_PCR1_Enter_Handler
GetSystemTimeAsFileTime_PCR2_Enter_Handler
GetSystemTimeAsFileTime_PCR3_Enter_Handler
GetSystemTimeAsFileTime_PCR4_Enter_Handler
GetSystemTimeAsFileTime_PCR5_Enter_Handler
GetSystemTimeAsFileTime_PCR6_Enter_Handler
GetSystemTimeAsFileTime_PCR7_Enter_Handler
GetSystemTimeAsFileTime_PCR8_Enter_Handler
GetSystemTimeAsFileTime_PCR99_Enter_Handler
GetSystemTimeAsFileTime_PCR9_Enter_Handler
GetSystemTimeAsFileTime_PCR_Enter_Handler
GetVersionExA_CW_BM_Enter_Handler
GetVersionExA_CW_UE_Enter_Handler
IcmCreateColorSpaceByName_Enter_Handler
Inj_CreateDirectoryW_Enter_Handler
Inj_DeviceIOControl_Enter_Handler
Inj_RemoveDirectoryW_Exit_Handler
Java_CreateRemoteThread_Enter_Handler
Java_VirtualAllocEx_Exit_Handler
Java_WriteProcessMemory_Enter_Handler
L_CreateFileW_Exit_Handler
L_LoadLibraryExW_Enter_Handler
MIMIDOTNET2JSCRIPT_CLSIDFromProgID_Enter_Handler
MIMIDOTNET2JSCRIPT_GetProcAddress_Enter_Handler
Macro_CreateThread_Entry_Handler
Macro_VirtualAlloc_Exit_Handler
Mktz_ReadProcessMemory_Exit_Handler
Motw_CLSIDFromString_Enter_Handler
MoveFileExW_Enter_Handler
MoveFileW_Enter_Handler
NOP_Handler
NdrConformantStringUnmarshall_Enter_Handler
NetpwPathCanonicalize_2K_Enter_Handler
NetpwPathCanonicalize_CVE_2008_4250_Enter_Handler
NetpwPathCanonicalize_XP_Enter_Handler
PSBC_GetModuleHandleA_Enter_Handler
PSBC_GetProcAddress_Enter_Handler
PSBC_LoadLibraryA_Enter_Handler
PSBC_RegSetValueExW_Enter_Handler
PSBC_SetEnvironmentVariableW_Enter_Handler
PSBC_ShowWindow_Enter_Handler
PSBC_SysAllocString_Enter_Handler
PSBC_WinHttpGetProxyForUrl_Enter_Handler
PSH_CreateProcessInternalW_Exit_Handler
PSH_ReadProcessMemory_Exit_Handler
PSH_ResumeThread_Enter_Handler
PSH_SetThreadContext_Enter_Handler
PSS_CreateProcessInternalW_Enter_Handler
PSS_UpdateProcThreadAttribute_Exit_Handler
PS_CreateFileMappingW_Enter_Handler
PS_CreateFileW_Exit_Handler
PS_CreateRemoteThread_Enter_Handler
PS_CreateThread_Enter_Handler
PS_HeapAlloc_Exit_Handler
PS_IsWow64Process_Enter_Handler
PS_LsaConnectUntrusted_Enter_Handler
PS_LsaLookupAuthenticationPackage_Enter_Handler
PS_NtCreateThreadEx_Enter_Handler
PS_NtQueryInformationProcess_Enter_Handler
PS_OpenProcess_Exit_Handler
PS_ReadProcessMemory_Enter_Handler
PS_VaultGetItem_Exit_Handler
PS_VirtualAllocEx_Exit_Handler
PS_VirtualAlloc_Exit_Handler
PS_VirtualProtect_Enter_Handler
PS_WriteProcessMemory_Enter_Handler
QMCreateObjectInternal_Enter_Handler
QMGetRemoteQueueName_Enter_Handler
QMObjectPathToObjectFormat_Enter_Handler
RCE_CLSIDFromProgID_Enter_Handler
RCE_CopyFileW_Enter_Handler
RCE_CreateFileW_Exit_Handler
RCE_CreateProcessA_Enter_Handler
RCE_CreateProcessAsUserA_Enter_Handler
RCE_CreateProcessAsUserW_Enter_Handler
RCE_CreateProcessInternalA_Enter_Handler
RCE_CreateProcessInternalW_Enter_Handler
RCE_CreateProcessW_Enter_Handler
RCE_CreateRemoteThread_Enter_Handler
RCE_GetTempPathA_Enter_Handler
RCE_GetTempPathW_Enter_Handler
RCE_InternetConnectW_Enter_Handler
RCE_LoadLibraryExW_Enter_Handler
RCE_URLDownloadToFileA_Enter_Handler
RCE_URLDownloadToFileW_Enter_Handler
RCE_VirtualAllocEx_Enter_Handler
RCE_VirtualAllocEx_Exit_Handler
RCE_VirtualProtect_Exit_Handler
RCE_WinExec_Enter_Handler
RCE_WriteProcessMemory_Enter_Handler
RCE_connect_Enter_Handler
RCE_recv_Exit_Handler
RCE_send_Exit_Handler
RD_CreateProcessInternalW_Enter_Handler
RegOps_RegOpenKeyExW_Enter_Handler
ScrUnescape_Enter_Handler
ScrUnescape_Enter_Handler_New
Scr_DeviceIOControl_Enter_Handler
SetConsoleCtrlHandler_PWSHCR10_Enter_Handler
SetConsoleCtrlHandler_PWSHCR1_Enter_Handler
SetConsoleCtrlHandler_PWSHCR2_Enter_Handler
SetConsoleCtrlHandler_PWSHCR3_Enter_Handler
SetConsoleCtrlHandler_PWSHCR4_Enter_Handler
SetConsoleCtrlHandler_PWSHCR5_Enter_Handler
SetConsoleCtrlHandler_PWSHCR6_Enter_Handler
SetConsoleCtrlHandler_PWSHCR7_Enter_Handler
SetConsoleCtrlHandler_PWSHCR8_Enter_Handler
SetConsoleCtrlHandler_PWSHCR9_Enter_Handler
SetConsoleCtrlHandler_PWSHCR_Enter_Handler
Spool_LdrLoadDll_Enter_Handler
Spool_NTCreateFile_Enter_Handler
Start_Printer_Enter_Handler
Vba_GetDiskFreeSpaceW_Enter_Handler
WMCreateEditor_Enter_Handler
_CreateDirectoryW_Enter_Handler
_LoadCPLModule_Enter_Handler
_LoadLibraryExW_Enter_Handler
_fcvt_Enter_Handler
_fcvt_Exit_Handler
dllInj_RTLUserThreadStart_Enter_Handler
lateBindingOn
shellInj_RTLUserThreadStart_Enter_Handler

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7010eefb43374b611f4b57e2c78ab965

Headers

DLL Characteristics

File Characteristics

Imports

psapi

shlwapi

kernel32

advapi32

shell32

dbghelp

ws2_32

Exports

Exports

Sections

.text Size: 217KB - Virtual size: 216KB

.rdata Size: 97KB - Virtual size: 97KB

.data Size: 4KB - Virtual size: 31KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 217KB - Virtual size: 216KB

.rdata
Size: 97KB - Virtual size: 97KB

.data
Size: 4KB - Virtual size: 31KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB