892be2109391be50052add0adf58028006e8fea2958be90e4b2d7d5ad520fd44

Sharing

Copy URL Twitter E-mail

General

Target

892be2109391be50052add0adf58028006e8fea2958be90e4b2d7d5ad520fd44
Size

87KB
MD5

5781588d6a8c9a981de64e37d33267b9
SHA1

f3dedaf9ff259b0f3775d6abe77fe1836d3348e8
SHA256

892be2109391be50052add0adf58028006e8fea2958be90e4b2d7d5ad520fd44
SHA512

ba17a36215a3c2061ed34003332cb3b207fc489ebf8c61d2358d38c172b11542f3487bba175abbc3653ad770b0c3d6dec0ba7fbc675423576df0d561cfbe8685
SSDEEP

1536:flv5ImoGlvElp282KovPVKeBgo8jzo1o3pxbY9VAFqGmmKPOzoI8Mihv4bu8gBWt:thvOp282KqmDxo2cGmpmJ8Mihgbu8gBM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
892be2109391be50052add0adf58028006e8fea2958be90e4b2d7d5ad520fd44

Files

892be2109391be50052add0adf58028006e8fea2958be90e4b2d7d5ad520fd44
.dll windows:6 windows x86 arch:x86

57952b6ec0a9706fd05b63e2e3d5393d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

pincrt

??2@YAPAXI@Z
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
NtClose
NtCreateEvent
NtCreateSection
NtDelayExecution
NtDuplicateObject
NtMapViewOfSection
NtQueryInformationProcess
NtQueryInformationThread
NtQuerySystemInformation
NtSetEvent
NtTerminateProcess
NtUnmapViewOfSection
NtWaitForMultipleObjects
OS_GetTid
OS_MutexGetOwner
OS_MutexGetRecursionLevel
OS_MutexLock
OS_MutexLockTid
OS_MutexRecursiveInit
OS_MutexTimedLockTid
OS_MutexTryLockTid
OS_MutexUnlock
OS_SyscallDoCall
OS_Time
__cxa_atexit
__cxa_finalize
__init_additionals
__init_win_std_files
__my_libc_init
_alldiv
_aulldiv
_purecall
abort
fclose
fflush
fopen
fread
free
fseeko
ftello
fwrite
gettimeofday
isspace
isxdigit
localtime
malloc
memchr
memcmp
memcpy_s
memmove
snprintf_s
sprintf
strftime
strlen
strnlen_s
strtol
strtoull
tolower

c++

??$?HDU?$char_traits@D@__1@std@@V?$allocator@D@12@@__1@std@@YA?AV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@01@PBDABV201@@Z
??0?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@IAE@XZ
??0?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAE@ABV012@@Z
??0?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAE@ABV012@IIABV?$allocator@D@12@@Z
??0locale@__1@std@@QAE@ABV012@@Z
??1?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@__1@std@@@__1@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAE@XZ
??1locale@__1@std@@QAE@XZ
?__init@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AAEXID@Z
?__init@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AAEXPBDI@Z
?__init@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@AAEXPBDII@Z
?append@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEAAV123@PBD@Z
?append@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEAAV123@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEAAV123@PBD@Z
?clear@ios_base@__1@std@@QAEXI@Z
?compare@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QBEHIIPBDI@Z
?cout@__1@std@@3V?$basic_ostream@DU?$char_traits@D@__1@std@@@12@A
?fill@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@QBEDXZ
?flush@?$basic_ostream@DU?$char_traits@D@__1@std@@@__1@std@@QAEAAV123@XZ
?getloc@ios_base@__1@std@@QBE?AVlocale@23@XZ
?has_facet@locale@__1@std@@ABE_NAAVid@123@@Z
?id@?$codecvt@DDU__mbstate_t@@@__1@std@@2V0locale@23@A
?id@?$ctype@D@__1@std@@2V0locale@23@A
?ignore@?$basic_istream@DU?$char_traits@D@__1@std@@@__1@std@@QAEAAV123@HH@Z
?init@?$basic_ios@DU?$char_traits@D@__1@std@@@__1@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@__1@std@@@23@@Z
?insert@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEAAV123@IPBD@Z
?is@?$ctype@D@__1@std@@QBE_NKD@Z
?push_back@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEXD@Z
?replace@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEAAV123@IIPBD@Z
?replace@?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@QAEAAV123@IIPBDI@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@MAEHXZ
?uncaught_exception@std@@YA_NXZ
?use_facet@locale@__1@std@@ABEPBVfacet@123@AAVid@123@@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@MAEHPADH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@__1@std@@@__1@std@@MAEHPBDH@Z

kernel32

CloseHandle
GetModuleFileNameW

Exports

Exports

??0IPC_CLIENT@LEVEL_BASE@@QAE@XZ
??0IPC_CLIENT_CONNECTION@LEVEL_BASE@@QAE@ABV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@K@Z
??0IPC_CLIENT_CONNECTION@LEVEL_BASE@@QAE@KPAX@Z
??0IPC_CONNECTION@LEVEL_BASE@@IAE@ABV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@K@Z
??0IPC_CONNECTION@LEVEL_BASE@@IAE@W4DATA_TRANSFER_MODE@01@KPAX@Z
??1IPC_CLIENT@LEVEL_BASE@@QAE@XZ
??1IPC_CLIENT_CONNECTION@LEVEL_BASE@@UAE@XZ
??1IPC_CONNECTION@LEVEL_BASE@@MAE@XZ
??4IPC_CLIENT@LEVEL_BASE@@QAEAAV01@ABV01@@Z
??_7IPC_CLIENT_CONNECTION@LEVEL_BASE@@6B@
??_7IPC_CONNECTION@LEVEL_BASE@@6B@
??_FIPC_CLIENT_CONNECTION@LEVEL_BASE@@QAEXXZ
?CloneConnectionInfo@IPC_CLIENT_CONNECTION@LEVEL_BASE@@UAE?AV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@PAX@Z
?CloneConnectionInfo@IPC_CONNECTION@LEVEL_BASE@@IAE?AV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@PAX0@Z
?Close@IPC_CLIENT@LEVEL_BASE@@QAEXXZ
?Close@IPC_CLIENT_CONNECTION@LEVEL_BASE@@QAEXXZ
?Close@IPC_CONNECTION@LEVEL_BASE@@IAEXXZ
?ConvertToName@IPC_CONNECTION@LEVEL_BASE@@SA?AV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@W4MESSAGE_STATUS@12@@Z
?GenericIpcClientConnection@LEVEL_BASE@@YAPAVIPC_CLIENT_CONNECTION@1@XZ
?GetConnectionInfo@IPC_CONNECTION@LEVEL_BASE@@MAEXXZ
?GetMessageA@IPC_CONNECTION@LEVEL_BASE@@IAE?AW4MESSAGE_STATUS@12@PAPAXPAKPA_NPAX@Z
?IPC_CLIENT_TIMEOUT@IPC_CLIENT_CONNECTION@LEVEL_BASE@@0IB
?Init@IPC_CLIENT@LEVEL_BASE@@QAE_NW4IPC_TYPE@2@@Z
?IsInitialized@IPC_CONNECTION@LEVEL_BASE@@QBE_NXZ
?RemoteProcedureCall@IPC_CLIENT@LEVEL_BASE@@QAE_NABV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@PAV345@@Z
?RemoteProcedureCall@IPC_CLIENT_CONNECTION@LEVEL_BASE@@QAE_NABV?$basic_string@DU?$char_traits@D@__1@std@@V?$allocator@D@23@@__1@std@@PAV345@@Z
?SendMessageA@IPC_CONNECTION@LEVEL_BASE@@IAE?AW4MESSAGE_STATUS@12@PBXK_N@Z
?SetGenericIpcClientConnection@LEVEL_BASE@@YAPAVIPC_CLIENT_CONNECTION@1@PAV21@@Z
?SetWaitableObject@IPC_CONNECTION@LEVEL_BASE@@QAE_NPAX@Z
?TIME_OUT@IPC_CLIENT@LEVEL_BASE@@0IB
PinCommitHashC
PinCommitHashSizeC

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pinvers
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57952b6ec0a9706fd05b63e2e3d5393d

Headers

DLL Characteristics

File Characteristics

Imports

pincrt

c++

kernel32

Exports

Exports

Sections

.text Size: 62KB - Virtual size: 62KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 80B

.pinvers Size: 512B - Virtual size: 10B

.rsrc Size: 512B - Virtual size: 396B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 62KB - Virtual size: 62KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 80B

.pinvers
Size: 512B - Virtual size: 10B

.rsrc
Size: 512B - Virtual size: 396B

.reloc
Size: 7KB - Virtual size: 6KB