287e45e677dd2cc2f5b3c17941d73d3786a30bff9de5d5e85a1ed78113c0aaf4

Sharing

Copy URL Twitter E-mail

General

Target

287e45e677dd2cc2f5b3c17941d73d3786a30bff9de5d5e85a1ed78113c0aaf4
Size

391KB
MD5

f1fc9c64e8ef45da4f8fb1918cdbbf4f
SHA1

35d96beb1c21c66b36fa6553acbec970221e7aa2
SHA256

287e45e677dd2cc2f5b3c17941d73d3786a30bff9de5d5e85a1ed78113c0aaf4
SHA512

344fb802667c69102033597a3ae5ca4f5a9713e03591fd2d9f6c9e0b6b813a4fac45c5a06c27019209a047a8d026828caa70319c3b46be97020acf55efea3ef3
SSDEEP

6144:oV2rH9agmj4mily/lpmUljvsUVTDI5qOmKx7M1Uml8nBOqhYl/wsexDA7UpnagGe:oVYUmpGkcz9VexDmUpagGh+r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
287e45e677dd2cc2f5b3c17941d73d3786a30bff9de5d5e85a1ed78113c0aaf4

Files

287e45e677dd2cc2f5b3c17941d73d3786a30bff9de5d5e85a1ed78113c0aaf4
.dll windows:5 windows x86 arch:x86

dad2fce1a543247670e15d1f31483d3f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedDecrement
CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetProcAddress
LoadLibraryA
GetModuleFileNameA
MultiByteToWideChar
GetLastError
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LeaveCriticalSection
LocalAlloc
GetCurrentThreadId
GetCurrentProcessId
GlobalMemoryStatus
GetVersionExA
GetTickCount
QueryPerformanceCounter
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
DecodePointer
GetCommandLineA
HeapReAlloc
RtlUnwind
LocalFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
RaiseException
WideCharToMultiByte
EnterCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetCPInfo
InterlockedIncrement
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
LCMapStringW
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
LoadLibraryW
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SetFilePointer
VirtualQuery
HeapSize
CreateFileA
WriteConsoleW
SetEndOfFile
GetProcessHeap
CreateFileW
CompareStringW
SetEnvironmentVariableA

user32

DispatchMessageA
TranslateMessage
PeekMessageA
SendMessageA
DialogBoxParamA
GetDlgItem
GetWindowTextA
EndDialog
MessageBoxA
SetFocus

advapi32

CryptGetHashParam
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptHashData
RegQueryValueExA

Exports

Exports

SKFEX_ECCDecrypt
SKFEX_RSADecrypt
SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCDecrypt
SKF_ECCExportSessionKey
SKF_ECCSignData
SKF_ECCVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_FormatCard
SKF_GenECCKeyPair
SKF_GenExtEccKey
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKeyWithECC
SKF_GetContainerType
SKF_GetContianerProperty
SKF_GetContianerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_GetRsaType
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_OpenApplication
SKF_OpenContainer
SKF_PriRsaDecrypt
SKF_PrvKeyDecrypt
SKF_RSADecrypt
SKF_RSAExportSessionKey
SKF_RSASignData
SKF_RSAVerify
SKF_ReadFile
SKF_SetLabel
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteFile

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

GPShared
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dad2fce1a543247670e15d1f31483d3f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 260KB - Virtual size: 260KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 25KB - Virtual size: 39KB

GPShared Size: 36KB - Virtual size: 35KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 260KB - Virtual size: 260KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 25KB - Virtual size: 39KB

GPShared
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB