4a86a6cdd03d15224a1631b61f489e43594b0e6361cfcee60ac4df221c69b228

Sharing

Copy URL Twitter E-mail

General

Target

4a86a6cdd03d15224a1631b61f489e43594b0e6361cfcee60ac4df221c69b228
Size

588KB
MD5

9a6a7b3c7526ac4771fbbcb443f379db
SHA1

09e0a29f230e20012c180d63e6cdfeeeef25cd08
SHA256

4a86a6cdd03d15224a1631b61f489e43594b0e6361cfcee60ac4df221c69b228
SHA512

a5c6bc4fc377e35b735b3679b9c89903a7f77939e9228210f815f4a59afeaccff327d73b30e4f74566c5639797879ae806591b5fd1b25229cb905954f0e33bd5
SSDEEP

12288:vb0NivLzOe6FsOoo3MKFU18cbSes5QLYSqJl1z1N4qRBIxF5:IeCfm2MH1Ies5lp/t1N6xF5

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/giuroll.dll
unpack001/giuroll_loader.exe
unpack001/giuroll_loader_dll.dll

Files

4a86a6cdd03d15224a1631b61f489e43594b0e6361cfcee60ac4df221c69b228
.zip
Installation-and-Usages.html
.html
LICENSE-giuroll.txt
LICENSE-giuroll_loader.txt
LICENSE-giuroll_loader_dll.txt
giuroll-default.ini
giuroll.dll
.dll windows:6 windows x86 arch:x86

8b98ed1cad415dd47624cf876f97af96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

giuroll.pdb

Imports

kernel32

GetModuleFileNameW
AcquireSRWLockExclusive
CloseHandle
HeapFree
WaitForSingleObject
GetCurrentThreadId
HeapAlloc
GetLastError
GetConsoleOutputCP
HeapSize
AllocConsole
WriteFile
SetStdHandle
GetStringTypeW
FreeLibrary
GetProcessHeap
LoadLibraryExA
FormatMessageW
GetCurrentProcessId
LCMapStringW
GetModuleHandleA
GetProcAddress
FindNextFileW
FindClose
CreateFileW
SetFileInformationByHandle
FlushFileBuffers
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFilePointerEx
GetCurrentProcess
SwitchToThread
VirtualProtect
GetCommandLineW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetThreadStackGuarantee
GetCurrentThread
AcquireSRWLockShared
ReleaseSRWLockShared
GetCommandLineA
GetCPInfo
GetOEMCP
CreateThread
CreateWaitableTimerExW
SetWaitableTimer
Sleep
GetACP
IsValidCodePage
GetSystemTimeAsFileTime
GetConsoleMode
GetFileType
GetModuleHandleW
ExitProcess
FindFirstFileExW
GetModuleHandleExW
LoadLibraryExW
GetStdHandle
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
CreateMutexA
HeapReAlloc
SetLastError
GetFullPathNameW
GetEnvironmentVariableW
TlsFree
GetCurrentDirectoryW
RtlCaptureContext
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
TerminateProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
ReleaseSRWLockExclusive
DecodePointer

user32

GetWindowTextW
MessageBoxW
SetWindowTextW

ws2_32

WSAGetLastError
closesocket
sendto

oleaut32

SysFreeString
SysStringLen

ntdll

NtReadFile
RtlNtStatusToDosError
NtWriteFile

advapi32

SystemFunction036

Exports

Exports

CheckVersion
Initialize
InitializeByLoader
addRollbackCb
cleanup
getPriority
is_likely_desynced
set_char_data_pos
set_char_data_size

Sections

.text
Size: 426KB - Virtual size: 426KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
giuroll.ini
giuroll_loader.exe
.exe windows:6 windows x86 arch:x86

432c724148ed41db2ee887cdef6aa777

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

giuroll_loader.pdb

Imports

kernel32

CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetLastError
GetExitCodeThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
TlsSetValue
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
DuplicateHandle
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
ReadFileEx
GetExitCodeProcess
TerminateProcess
WaitForMultipleObjects
GetOverlappedResult
QueryPerformanceCounter
TryAcquireSRWLockExclusive
TlsGetValue
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
CreateEventW
ReadFile
CancelIo
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateThread
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DecodePointer

bcrypt

BCryptGenRandom

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
giuroll_loader_dll.dll
.dll windows:6 windows x86 arch:x86

a477cff287d5e3a084434ec45fe85934

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

giuroll_loader_dll.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
GetLastError
FreeLibrary
GetModuleFileNameW
CloseHandle
FreeLibraryAndExitThread
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeEnvironmentStringsW
ReleaseMutex
FindClose
ReleaseSRWLockShared
SetThreadStackGuarantee
TlsSetValue
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
TerminateProcess
QueryPerformanceCounter
TlsGetValue
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
GetModuleHandleW
FormatMessageW
ExitProcess
GetFullPathNameW
CreateThread
GetModuleHandleA
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
WriteFile
SetStdHandle
HeapSize
GetStringTypeW
GetFileType
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetModuleHandleExW
LoadLibraryExW
TlsFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
RaiseException
InterlockedFlushSList
DecodePointer

user32

MessageBoxA

Exports

Exports

CheckVersion
DllMain
Initialize
getPriority
rust_eh_personality

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
verifiable-source-code-and-build.url

Sharing

General

Malware Config

Signatures

Files

8b98ed1cad415dd47624cf876f97af96

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ws2_32

oleaut32

ntdll

advapi32

Exports

Exports

Sections

.text Size: 426KB - Virtual size: 426KB

.rdata Size: 87KB - Virtual size: 87KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 18KB

432c724148ed41db2ee887cdef6aa777

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

bcrypt

Sections

.text Size: 222KB - Virtual size: 221KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 10KB - Virtual size: 10KB

a477cff287d5e3a084434ec45fe85934

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 179KB - Virtual size: 179KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 426KB - Virtual size: 426KB

.rdata
Size: 87KB - Virtual size: 87KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 18KB

.text
Size: 222KB - Virtual size: 221KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 10KB - Virtual size: 10KB

.text
Size: 179KB - Virtual size: 179KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 9KB - Virtual size: 9KB