77b411c2e3f453f68900cf38ab9d45316ac85481def42b6bd94120453c4a6ea0

Sharing

Copy URL Twitter E-mail

General

Target

77b411c2e3f453f68900cf38ab9d45316ac85481def42b6bd94120453c4a6ea0
Size

255KB
MD5

6b2795a36c26207970f764fc0e5fa317
SHA1

ff424811630477cfa060319231b51efb1345ffed
SHA256

77b411c2e3f453f68900cf38ab9d45316ac85481def42b6bd94120453c4a6ea0
SHA512

c7cc42c16b3128f5b47867a5e213558f8400e1a0ab6edb69ad2dc801c467275ad89cc45782b85ed1bf65bc678cae4bead5f45faf7da37e9d64e23c6abe682d65
SSDEEP

6144:nNsbelD6YkBqw+sAwkLGzF9W8ElBgdee82/:NsylCww+rUF9W8ElBgdw2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77b411c2e3f453f68900cf38ab9d45316ac85481def42b6bd94120453c4a6ea0

Files

77b411c2e3f453f68900cf38ab9d45316ac85481def42b6bd94120453c4a6ea0
.dll windows:6 windows x64 arch:x64

b252032afe35c9ddc43cc32a7b1485a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\build\endpoint\bin\x64\Release\Product.Integration.AL.dll.pdb

Imports

crypt32

CertNameToStrW
CryptHashCertificate2

epsjson

?isBool@Value@Json@@QEBA_NXZ
?asBool@Value@Json@@QEBA_NXZ
?isInt@Value@Json@@QEBA_NXZ
?asInt@Value@Json@@QEBAHXZ
?isUInt@Value@Json@@QEBA_NXZ
?asUInt@Value@Json@@QEBAIXZ
?isString@Value@Json@@QEBA_NXZ
?asString@Value@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1Value@Json@@QEAA@XZ
?isObject@Value@Json@@QEBA_NXZ
??4Value@Json@@QEAAAEAV01@V01@@Z
??0Value@Json@@QEAA@W4ValueType@1@@Z
?isMember@Value@Json@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??AValue@Json@@QEAAAEAV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isArray@Value@Json@@QEBA_NXZ
?isValidIndex@Value@Json@@QEBA_NI@Z
??AValue@Json@@QEAAAEAV01@H@Z
?isNull@Value@Json@@QEBA_NXZ
?empty@Value@Json@@QEBA_NXZ
??0Reader@Json@@QEAA@XZ
??1Reader@Json@@QEAA@XZ
?parse@Reader@Json@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAVValue@2@_N@Z
?getMemberNames@Value@Json@@QEBA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?size@Value@Json@@QEBAIXZ
?isMember@Value@Json@@QEBA_NPEBD@Z
??AValue@Json@@QEAAAEAV01@PEBD@Z
?isInt64@Value@Json@@QEBA_NXZ
?asInt64@Value@Json@@QEBA_JXZ
?isUInt64@Value@Json@@QEBA_NXZ
?asUInt64@Value@Json@@QEBA_KXZ

kernel32

Sleep
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
FindResourceW
LoadResource
SizeofResource
LockResource
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryExW
GetModuleHandleW
CreateDirectoryW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext

msvcp140

?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
_Mtx_init_in_situ
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Mtx_destroy_in_situ

winmm

timeGetTime

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathRemoveBackslashW
PathAddBackslashW
PathIsRelativeW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
__std_exception_destroy
__std_terminate
wcsrchr
__std_type_info_destroy_list
memset
memcpy
memcmp
_CxxThrowException
__RTDynamicCast
_purecall
__C_specific_handler
strchr
wcschr
memmove

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
realloc

api-ms-win-crt-string-l1-1-0

_wcslwr
wcscat_s
wcsncpy_s
wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_cexit
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-multibyte-l1-1-0

_mbscmp
_mbsicmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

BdCreateObject
BdDestroyObject

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b252032afe35c9ddc43cc32a7b1485a9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

epsjson

kernel32

msvcp140

winmm

shlwapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 185KB - Virtual size: 184KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 7KB - Virtual size: 9KB

.pdata Size: 10KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 672B

.text
Size: 185KB - Virtual size: 184KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 7KB - Virtual size: 9KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 672B