7d3c7c16d597215753fd8496edb28bd40e48fddcb681c1c4513c346b73a72ff8

Sharing

Copy URL

Twitter E-mail

General

Target

7d3c7c16d597215753fd8496edb28bd40e48fddcb681c1c4513c346b73a72ff8
Size

262KB
MD5

2f38ea08208048c4f75f9b11b058a55b
SHA1

21b4146a9c07e1975b5b1c57508cffc6eff94d3d
SHA256

7d3c7c16d597215753fd8496edb28bd40e48fddcb681c1c4513c346b73a72ff8
SHA512

b026680f958582a0874d323ccffb6032f0d810e0ca022aca38098dce80112c3dbf7d52cfcd24cdcaa71a295a88a7f70b5ce20ba5dde6a7ea6b4fdf0dbc046c6f
SSDEEP

6144:wXHF2Vno6x9iICjvslhr+39wCMQUdluzJC4pv9NwzufFKiiQZXY+I7k:q2dBjCj0lhr+39wCMQUdluzJC4pv9NwS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d3c7c16d597215753fd8496edb28bd40e48fddcb681c1c4513c346b73a72ff8

Files

7d3c7c16d597215753fd8496edb28bd40e48fddcb681c1c4513c346b73a72ff8
.dll windows:6 windows x64 arch:x64

3655a6b83b3dab6d9fea3cf5ed52020e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\build\endpoint\bin\x64\Release\AtcIntegration.dll.pdb

Imports

epsjson

??0Value@Json@@QEAA@$$QEAV01@@Z
??0Value@Json@@QEAA@_J@Z
?isInt64@Value@Json@@QEBA_NXZ
??0Value@Json@@QEAA@W4ValueType@1@@Z
?write@FastWriter@Json@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVValue@2@@Z
??1FastWriter@Json@@UEAA@XZ
??0FastWriter@Json@@QEAA@XZ
??0Value@Json@@QEAA@AEBV01@@Z
?isNull@Value@Json@@QEBA_NXZ
??AValue@Json@@QEAAAEAV01@PEBD@Z
?isValidIndex@Value@Json@@QEBA_NI@Z
?isArray@Value@Json@@QEBA_NXZ
??AValue@Json@@QEAAAEAV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isMember@Value@Json@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4Value@Json@@QEAAAEAV01@V01@@Z
?isObject@Value@Json@@QEBA_NXZ
??0Value@Json@@QEAA@PEBD@Z
??0Value@Json@@QEAA@H@Z
??0Value@Json@@QEAA@_N@Z
??1Value@Json@@QEAA@XZ
??AValue@Json@@QEAAAEAV01@H@Z

kernel32

VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
SetFileTime
FlushFileBuffers
CreateDirectoryW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindFirstFileW
FindClose
FindNextFileW
GetWindowsDirectoryW
GetCurrentThreadId
MoveFileExW
CopyFileW
DeleteFileW
InitializeCriticalSectionAndSpinCount
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
InitializeSListHead
GetSystemTimeAsFileTime
SetLastError
GetExitCodeProcess
TerminateProcess
CreateProcessW
CreateFileW
GetSystemDirectoryW
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSectionEx
WideCharToMultiByte
MultiByteToWideChar
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
WaitForSingleObject
CloseHandle
Sleep
VerSetConditionMask
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent

advapi32

RegEnumKeyExW
QueryServiceStatus
CreateServiceW
DeleteService
QueryServiceConfigW
OpenSCManagerW
ChangeServiceConfigW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
CloseServiceHandle
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyExW
StartTraceW
EnableTrace
ControlTraceW
OpenServiceW

ole32

CLSIDFromString

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Syserror_map@std@@YAPEBDH@Z
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

shlwapi

PathAddExtensionW
PathIsDirectoryW
PathAddBackslashW
PathFileExistsW
PathRemoveBackslashW
PathRemoveFileSpecW
PathIsRelativeW

winmm

timeGetTime

setupapi

InstallHinfSectionW
SetupSetNonInteractiveMode

rpcrt4

UuidCreate

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
_purecall
memcmp
memcpy
__RTDynamicCast
memmove
memset
__std_exception_destroy
__std_type_info_destroy_list
_CxxThrowException
__C_specific_handler
__current_exception_context
__std_exception_copy
wcschr
__current_exception
wcsrchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswscanf
_get_stream_buffer_pointers
fread
fwrite
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
ungetc
fputc
fgetc
fclose

api-ms-win-crt-heap-l1-1-0

_callnewh
free
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initterm_e
_errno
_invalid_parameter_noinfo_noreturn
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wcscpy_s
wcscspn
wcsspn
wcsncpy_s
_wcsicmp
wcscat_s

api-ms-win-crt-convert-l1-1-0

wcstoul
wcstoull
_wtol
atoi

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

BdCreateObject
BdDestroyObject

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3655a6b83b3dab6d9fea3cf5ed52020e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

epsjson

kernel32

advapi32

ole32

msvcp140

shlwapi

winmm

setupapi

rpcrt4

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 185KB - Virtual size: 184KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 772B

.text
Size: 185KB - Virtual size: 184KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 772B