387c6b6029d3cef1b848a16747c877bb95f1570e6b0bdce358bd9d5c60efc431

Sharing

Copy URL Twitter E-mail

General

Target

387c6b6029d3cef1b848a16747c877bb95f1570e6b0bdce358bd9d5c60efc431
Size

826KB
MD5

36916676786a72f5e2dd97167ea1d621
SHA1

51f0fc9ec920fe4c9f63cce401423f1543a645cf
SHA256

387c6b6029d3cef1b848a16747c877bb95f1570e6b0bdce358bd9d5c60efc431
SHA512

11b24fa9c085139b148834413caab4ea10138687e04398a1eb144ecacdf8cbbe871ea7701e83db41cfce76918ee6fc97b2f6b19c11417d8f71611eec8d9f1f70
SSDEEP

12288:cXEc1QqQR/cp/ZykQZWtwRAJHEnxKy6zAECrwuX0MP4pFJ0O:5KQIJZCANIxKZsFrRdPsn0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
387c6b6029d3cef1b848a16747c877bb95f1570e6b0bdce358bd9d5c60efc431

Files

387c6b6029d3cef1b848a16747c877bb95f1570e6b0bdce358bd9d5c60efc431
.exe windows:5 windows x86 arch:x86

eab3a07c63317e7f7d07fb98d7f880dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\dtl_dep\PC\dtlinstallbuilder\bin\DTLUnInstall_NU.pdb

Imports

kernel32

SetLastError
OpenProcess
GetExitCodeProcess
WaitForSingleObject
FormatMessageA
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLogicalDriveStringsW
QueryDosDeviceW
GetModuleFileNameW
GetWindowsDirectoryW
GetCurrentDirectoryW
CreateEventW
SetEvent
FindClose
FindFirstFileW
GetFullPathNameW
FindNextFileW
ExpandEnvironmentStringsW
MultiByteToWideChar
LoadLibraryExW
OutputDebugStringW
lstrcmpA
lstrcmpW
FreeResource
ExitProcess
SetCurrentDirectoryW
GetFileAttributesW
SetFileAttributesW
TerminateProcess
lstrcmpiW
MoveFileExW
SetEnvironmentVariableW
VirtualProtect
GetVersionExW
GetCommandLineW
FindResourceExW
CreateProcessW
CreateDirectoryW
CopyFileW
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
CreatePipe
GetFileAttributesExW
ReadConsoleW
GetConsoleMode
LocalFree
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetCurrentProcess
DeleteFileW
GetTempFileNameW
WriteFile
GetModuleHandleW
GetProcAddress
CreateFileW
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryW
VerifyVersionInfoW
VerSetConditionMask
FreeLibrary
Sleep
GetTickCount
GetLastError
CreateMutexW
RemoveDirectoryW
CloseHandle
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetACP
GetStdHandle
ReadFile
CreateProcessA
DuplicateHandle
GetTempPathW
QueryPerformanceFrequency
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
LoadLibraryExA
GetModuleFileNameA
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStringTypeW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile

user32

ExitWindowsEx
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SwitchToThisWindow
LoadStringW
CloseClipboard
EmptyClipboard
FindWindowW
EnumWindows
GetWindowThreadProcessId
PostMessageW
MessageBoxW
OpenClipboard

advapi32

RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetNamedSecurityInfoW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
AddAce
InitializeAcl
IsValidSid
GetLengthSid
LookupAccountNameW
CopySid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatusEx
EnumDependentServicesW
ControlService
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegDeleteValueW

shell32

ShellExecuteExW
SHFileOperationW
ShellExecuteW
CommandLineToArgvW
ord165
DragQueryFileW
SHChangeNotify
SHGetSpecialFolderPathW
ord190

ole32

OleGetClipboard
CoUninitialize
PropVariantClear
CoInitialize
CoCreateInstance
ReleaseStgMedium
OleInitialize
CoTaskMemFree
OleUninitialize

oleaut32

SysAllocString
VariantClear
SysFreeString
SysAllocStringLen
VarBstrCmp
VariantInit

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
SHStrDupW
PathAddBackslashW
PathAppendW
PathCombineW
PathIsDirectoryW
StrToIntExW
PathIsRelativeW
PathQuoteSpacesW
PathUnquoteSpacesW
PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetProcessImageFileNameW

urlmon

URLDownloadToFileW

Sections

.text
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 342KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eab3a07c63317e7f7d07fb98d7f880dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

urlmon

Sections

.text Size: 349KB - Virtual size: 349KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 5KB - Virtual size: 8KB

.gfids Size: 1024B - Virtual size: 516B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 342KB - Virtual size: 342KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 349KB - Virtual size: 349KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 5KB - Virtual size: 8KB

.gfids
Size: 1024B - Virtual size: 516B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 342KB - Virtual size: 342KB

.reloc
Size: 16KB - Virtual size: 16KB