5f065ed726a18613ab8dcb1e723f925e4972e116fe9054b2eb747d7d10dc7b39

Sharing

Copy URL

Twitter E-mail

General

Target

5f065ed726a18613ab8dcb1e723f925e4972e116fe9054b2eb747d7d10dc7b39
Size

3.6MB
MD5

0e2220b7425311ff667585e1ad9e47ae
SHA1

b2804e12a3505e41fc54bada9cfe85de62784fdf
SHA256

5f065ed726a18613ab8dcb1e723f925e4972e116fe9054b2eb747d7d10dc7b39
SHA512

d9a09d574127afbc47e593fe7575dea3ffd55d8c2981fec7b8a6e5b3133a509674a3fc74010f3f5b7b9314dffdc2e1d8c607ebc19eacc1dbbc670eaaa06e13e1
SSDEEP

49152:GyCXO4CvVMXz5COxzfo+qw3jlujD0PXz/PJybDMsqnrXiBgi5oyVALl9R:oYEbT3BVssj8gCoygl3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f065ed726a18613ab8dcb1e723f925e4972e116fe9054b2eb747d7d10dc7b39

Files

5f065ed726a18613ab8dcb1e723f925e4972e116fe9054b2eb747d7d10dc7b39
.dll windows:6 windows x64 arch:x64

154860a1a3cdc945c1061126b648d498

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

AcquireSRWLockExclusive
AreFileApisANSI
CheckRemoteDebuggerPresent
CloseHandle
CompareStringW
CreateDirectoryA
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateRemoteThread
CreateRemoteThreadEx
CreateThread
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesExW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetProcessId
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadId
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GlobalMemoryStatus
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32EnumDeviceDrivers
K32EnumProcesses
K32GetDeviceDriverBaseNameA
K32GetDeviceDriverFileNameA
K32GetModuleFileNameExA
K32GetModuleInformation
K32GetProcessImageFileNameA
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OpenThread
PeekNamedPipe
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleInputW
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseSRWLockExclusive
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetStdHandle
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WinExec
WriteConsoleW
WriteFile

user32

BeginPaint
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EndPaint
FillRect
FindWindowA
FindWindowExA
GetClassNameA
GetClientRect
GetDC
GetMessageW
GetProcessWindowStation
GetRawInputDeviceInfoW
GetRawInputDeviceList
GetSystemMetrics
GetUserObjectInformationW
GetWindow
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InvalidateRect
MessageBoxA
MessageBoxW
PostQuitMessage
RegisterClassW
SetWindowPos
ShowWindow
TranslateMessage
UpdateWindow

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreatePatternBrush
CreateSolidBrush
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject
SetBrushOrgEx
SetStretchBltMode

ole32

CreateStreamOnHGlobal

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
DeregisterEventSource
FreeSid
GetSecurityInfo
GetTokenInformation
GetUserNameA
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
LookupPrivilegeValueA
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceW
ReportEventW
RevertToSelf
SetEntriesInAclA
SetSecurityDescriptorDacl
SetSecurityInfo

ntdll

LdrLoadDll
NtAdjustPrivilegesToken
NtAlertResumeThread
NtClose
NtCreateFile
NtCreateThread
NtCreateThreadEx
NtDuplicateToken
NtOpenProcessToken
NtProtectVirtualMemory
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVirtualMemory
NtSetInformationProcess
NtSetInformationThread
NtSuspendThread
NtTerminateProcess
NtTerminateThread
RtlCreateUserThread
RtlImageNtHeader
ZwQuerySystemInformation

iphlpapi

GetAdaptersInfo
GetTcpTable2

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
closesocket
gethostbyname
getpeername
htons
inet_addr
inet_ntoa
ntohl
ntohs
recvfrom
select
sendto
socket

dxgi

CreateDXGIFactory

dbghelp

ImageRvaToVa

gdiplus

GdipAlloc
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdiplusShutdown
GdiplusStartup

Exports

Exports

JNI_OnLoad
Java_dimension_DimensionAPI_addSelfFrom
Java_dimension_DimensionAPI_appendTasks
Java_dimension_DimensionAPI_calculate
Java_dimension_DimensionAPI_closeSource
Java_dimension_DimensionAPI_createTempBitMap
Java_dimension_DimensionAPI_deleteCache
Java_dimension_DimensionAPI_exitCalculate
Java_dimension_DimensionAPI_freeThreadPool
Java_dimension_DimensionAPI_getHuzpsbPY
Java_dimension_DimensionAPI_getMyLastError
Java_dimension_DimensionAPI_getMyLocaleInfo
Java_dimension_DimensionAPI_getPoolState
Java_dimension_DimensionAPI_getVeroFessPY
Java_dimension_DimensionAPI_initialThreadPool
Java_dimension_DimensionAPI_isValid
Java_dimension_DimensionAPI_moveSelfTo
Java_dimension_DimensionAPI_validate

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 465KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 58B

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

154860a1a3cdc945c1061126b648d498

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

advapi32

ntdll

iphlpapi

ws2_32

dxgi

dbghelp

gdiplus

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 465KB - Virtual size: 511KB

.pdata Size: 63KB - Virtual size: 63KB

.00cfg Size: 512B - Virtual size: 40B

.tls Size: 512B - Virtual size: 9B

.voltbl Size: 512B - Virtual size: 58B

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 424B

.reloc Size: 70KB - Virtual size: 69KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 465KB - Virtual size: 511KB

.pdata
Size: 63KB - Virtual size: 63KB

.00cfg
Size: 512B - Virtual size: 40B

.tls
Size: 512B - Virtual size: 9B

.voltbl
Size: 512B - Virtual size: 58B

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 424B

.reloc
Size: 70KB - Virtual size: 69KB