a02efe54e12c73e0d6d9f882ca83c3617bf2b216315341570a5e857b7328fb1d

Sharing

Copy URL Twitter E-mail

General

Target

a02efe54e12c73e0d6d9f882ca83c3617bf2b216315341570a5e857b7328fb1d
Size

662KB
MD5

83220feef4c7d11413d78588260ea72d
SHA1

7db6269531f411147d2f7195a86b2a77ff6bbde6
SHA256

a02efe54e12c73e0d6d9f882ca83c3617bf2b216315341570a5e857b7328fb1d
SHA512

b711ff169a79fb39ef8e09b39ac354fd953f039e9d6eb23260e2eed4af311df702a973c250a3b4104c8a39d5ff2ef108a7bce2404e734b2077bb99578702c7ab
SSDEEP

12288:FY5vNt1KTp9ePpinzJ9cafmeBSKqmMc1w9ddcYxJ:FY5FtS7Si9cauZhmMcm9ncYx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a02efe54e12c73e0d6d9f882ca83c3617bf2b216315341570a5e857b7328fb1d

Files

a02efe54e12c73e0d6d9f882ca83c3617bf2b216315341570a5e857b7328fb1d
.dll windows:5 windows x64 arch:x64

56bf129eb7c578da9a2e982f19decf5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\po\trunk\modules\prntmgr\Release\prntmgr64.pdb

Imports

kernel32

GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
GetLocalTime
GetComputerNameW
Sleep
CreateThread
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcmpA
GetCurrentProcessId
CloseHandle
lstrcatW
lstrcmpiW
EnterCriticalSection
lstrcmpiA
SetLastError
GetCurrentDirectoryW
GetLastError
GetTempPathW
lstrlenW
lstrcpynW
LoadLibraryExA
LoadLibraryExW
LeaveCriticalSection
VirtualAlloc
SuspendThread
VirtualFree
GetThreadContext
SetThreadContext
FlushInstructionCache
ResumeThread
VirtualProtect
SetFilePointer
WriteFileEx
ReadFileEx
WaitNamedPipeW
WaitForSingleObjectEx
MoveFileW
GetSystemDirectoryW
GetWindowsDirectoryW
InitializeCriticalSection
GetCurrentThread
GetTickCount
lstrcpyA
lstrcpyW
LocalFree
DeleteFileW
Module32NextW
GetFileAttributesExW
CreateToolhelp32Snapshot
FindNextFileW
GetModuleHandleA
Process32NextW
Module32FirstW
DeviceIoControl
CreateEventW
CreateFileMappingW
ProcessIdToSessionId
Process32FirstW
FindClose
GetFileSizeEx
lstrcmpW
CreateFileW
ReadFile
GetFileAttributesW
GetVersionExW
CopyFileW
OpenProcess
IsBadReadPtr
OutputDebugStringW
lstrlenA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlUnwindEx
HeapAlloc
HeapFree
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapSize
GetModuleHandleW
GetProcAddress
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
CreateFileA
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
VirtualQuery
lstrcpynA
CreateProcessW
SetEvent
WriteConsoleW

user32

GetDC
GetMessageW
PostQuitMessage
LoadCursorW
CallNextHookEx
TranslateMessage
RegisterClassExW
LoadIconW
IsWindow
CreateWindowExW
DispatchMessageA
SetWindowsHookExW
UpdateWindow
DefWindowProcW

gdi32

GetStockObject
GetObjectA
GetDeviceCaps

winspool.drv

EnumPrintersW

advapi32

InitializeSecurityDescriptor
QueryServiceStatus
SetFileSecurityW
AllocateAndInitializeSid
GetUserNameW
RevertToSelf
ImpersonateLoggedOnUser
SetEntriesInAclW
RegEnumValueW
FreeSid
RegOpenKeyExW
CreateServiceW
CloseServiceHandle
OpenProcessToken
DeleteService
OpenSCManagerW
OpenServiceW
CreateProcessAsUserW
StartServiceW
SetSecurityDescriptorDacl
RegCloseKey

shlwapi

StrCatW
wvnsprintfA
wnsprintfA
StrChrA
SHSetValueW
PathFindExtensionW
PathFindFileNameW
StrStrIW
PathFileExistsW
PathAppendW
wnsprintfW
wvnsprintfW
PathIsDirectoryW
SHGetValueA
StrNCatW
PathRemoveFileSpecW
StrChrW
SHGetValueW

ws2_32

socket
sendto
WSAStartup

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

gdiplus

GdipCloneBrush
GdipDeleteGraphics
GdipCreateTexture
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateFromHDC
GdipFillRectangleI
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGraphicsClear
GdipCreateSolidFill
GdipDrawImageI
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipFillEllipseI
GdipScaleWorldTransform
GdipSetInterpolationMode
GdipCreateFontFromLogfontA
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipDeleteFont
GdipSetStringFormatAlign
GdipSetSmoothingMode
GdipSetPageUnit
GdipTranslateTextureTransform
GdipDeleteFontFamily
GdipCreateFont
GdipRotateWorldTransform
GdipResetWorldTransform
GdipGetGenericFontFamilySansSerif
GdipDrawImagePointRect
GdipDrawString
GdipTranslateWorldTransform
GdipCreateFontFamilyFromName
GdipCreateLineBrushI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateFontFromDC
GdipDrawImageRectI
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdiplusStartup

shell32

SHGetSpecialFolderPathW
ord165

ole32

CoCreateGuid

Sections

.text
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56bf129eb7c578da9a2e982f19decf5c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

ws2_32

wtsapi32

userenv

gdiplus

shell32

ole32

Sections

.text Size: 470KB - Virtual size: 470KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 16KB - Virtual size: 32KB

.pdata Size: 31KB - Virtual size: 30KB

.detourd Size: 512B - Virtual size: 24B

.detourc Size: 8KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 470KB - Virtual size: 470KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 16KB - Virtual size: 32KB

.pdata
Size: 31KB - Virtual size: 30KB

.detourd
Size: 512B - Virtual size: 24B

.detourc
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB