974c29dd7d7539a82bb0edbc134f0f87bb8674b3b1303841e9de5f4373c28c43

Sharing

Copy URL Twitter E-mail

General

Target

974c29dd7d7539a82bb0edbc134f0f87bb8674b3b1303841e9de5f4373c28c43
Size

255KB
MD5

898b87b1cb460367acfb0a30d82f67ee
SHA1

4ecfbe2768de8093adf64550116fbea8ff638f26
SHA256

974c29dd7d7539a82bb0edbc134f0f87bb8674b3b1303841e9de5f4373c28c43
SHA512

87cf6a425b7136dffba1dfaa57f67c8908dbc8fdf457fc9dd46e6c7d37a7551f5ef6f3863a5fc7f36e80d4b037ae90e67d816320b62dde15e1d2bb6c7c34fb69
SSDEEP

6144:ihWsDBEzJMrnWMrYJ9OLK49NYj8uwAO2EA:jYBEEYJ9OLK49NAwdA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
974c29dd7d7539a82bb0edbc134f0f87bb8674b3b1303841e9de5f4373c28c43

Files

974c29dd7d7539a82bb0edbc134f0f87bb8674b3b1303841e9de5f4373c28c43
.dll windows:5 windows x86 arch:x86

4ec1ea60bf4798581977501e880d75e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
FlushFileBuffers
GetCurrentProcess
GetModuleHandleA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalFlags
HeapAlloc
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
Sleep
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
VirtualQuery
VirtualProtect
VirtualQueryEx
VirtualProtectEx
InterlockedCompareExchange
FlushInstructionCache
SetThreadContext
GetThreadContext
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
lstrcmpW
GetVersionExA
lstrcmpA
InterlockedIncrement
SuspendThread
GetCurrentThreadId
ResumeThread
FormatMessageW
GetCurrentProcessId
FreeLibrary
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GlobalLock
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
GetLastError
SetLastError
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
lstrlenW
MultiByteToWideChar
CreateFileW
ReadFile
CreateProcessA
WideCharToMultiByte
GetCurrentThread
CreateProcessW
lstrlenA
SetFilePointer
IsDebuggerPresent
GetFileSize

user32

PostQuitMessage
ClientToScreen
SetWindowTextW
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
GrayStringW
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextW
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
MessageBoxW
MessageBoxA
DrawTextExW
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
GetKeyState
PeekMessageW
DrawTextW
TabbedTextOutW
DestroyMenu
DestroyWindow
UnhookWindowsHookEx
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongW
GetParent
SendMessageW
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
GetMenuItemID
ValidateRect
GetMenuState

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ws2_32

closesocket
socket
bind
WSACleanup
sendto
setsockopt
shutdown
htons
WSAStartup
inet_addr

oleacc

LresultFromObject
CreateStdAccessibleObject

gdi32

CreateBitmap
RectVisible
ScaleWindowExtEx
SetWindowExtEx
GetClipBox
SetTextColor
SetBkColor
DeleteObject
ExtTextOutW
SaveDC
RestoreDC
SetMapMode
DeleteDC
GetStockObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
PtVisible
TextOutW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ec1ea60bf4798581977501e880d75e8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

oleacc

gdi32

winspool.drv

oleaut32

Sections

.text Size: 162KB - Virtual size: 161KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 9KB - Virtual size: 24KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 162KB - Virtual size: 161KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 9KB - Virtual size: 24KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 31KB - Virtual size: 30KB