64fbe2f9b8cc45b4d13faa17c43b6f1b1a7c34f0dda9a6a58fb23a5f28a979ef

Sharing

Copy URL Twitter E-mail

General

Target

64fbe2f9b8cc45b4d13faa17c43b6f1b1a7c34f0dda9a6a58fb23a5f28a979ef
Size

160KB
MD5

f33a397251fd4b63819116b4dc1222a7
SHA1

5471679d76b2a0d75b065b95b8c00527af489b48
SHA256

64fbe2f9b8cc45b4d13faa17c43b6f1b1a7c34f0dda9a6a58fb23a5f28a979ef
SHA512

c05db1544fa9e60b3882a2f134a1d0cbffa00cd60d300c7a1b69612ddda5cc1edeee34501c8d62cdcc419381e57a45f214615433759e951e844033c476970efd
SSDEEP

3072:3osAlwXorPBTLmy/GHmVXKrD8GF3MWu+Aq7cDyOWckVPxIiTm8wdxGJ:3o1PBnAHgGDzF3ohuOh8w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64fbe2f9b8cc45b4d13faa17c43b6f1b1a7c34f0dda9a6a58fb23a5f28a979ef

Files

64fbe2f9b8cc45b4d13faa17c43b6f1b1a7c34f0dda9a6a58fb23a5f28a979ef
.dll windows:6 windows x64 arch:x64

6ad1401f3dd0ee90433be3e318b633c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVolumeInformationW
SetLastError
GetCurrentProcess
ExitProcess
GetCurrentThread
GetCurrentThreadId
UpdateProcThreadAttribute
GetTickCount64
GetSystemDirectoryW
CreateFileMappingW
MapViewOfFile
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
lstrcpyW
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetComputerNameW
K32GetModuleInformation
GetLastError
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
FreeLibrary
GetFullPathNameW
GetModuleHandleExW
RaiseException
EncodePointer
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetFileSize
ExpandEnvironmentStringsW
CreateFileW
GetCommandLineW
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
QueryPerformanceCounter
Sleep
CloseHandle

user32

FindWindowExW
EnumWindows
GetParent
SetWindowsHookExW
CallNextHookEx
GetAncestor
PtInRect
WindowFromPoint
GetWindowRect
GetForegroundWindow
GetSystemMetrics
SendInput
keybd_event
VkKeyScanW
GetKeyState
GetFocus
ShowWindow
IsWindowVisible
SendMessageTimeoutW
RegisterHotKey
DispatchMessageW
TranslateMessage
GetClassNameW
GetMessageW

shell32

ShellExecuteExW
CommandLineToArgvW

oleaut32

SysFreeString

propsys

PSStringFromPropertyKey

shlwapi

PathFileExistsW
PathRemoveFileSpecW
ord437
PathCanonicalizeW

crypt32

CryptUnprotectData
CryptProtectData

advapi32

LogonUserW

netapi32

NetUserGetInfo

oleacc

AccessibleObjectFromWindow
AccessibleChildren

msvcrt

_msize
_amsg_exit
__C_specific_handler
memset
memmove
memcpy
memcmp
memchr
_CxxThrowException
wcsstr
__getmainargs
__CppXcptFilter
?terminate@@YAXXZ
_errno
strcpy_s
_initterm_e
_initterm
_callnewh
abort
wcscmp
ceilf
_beginthreadex
_wtoi
realloc
malloc
free
_wcsdup
_memicmp
tolower
toupper
isalnum
isspace
isdigit
_local_unwind
__CxxFrameHandler3
__DestructExceptionObject

Exports

Exports

?portable@@YAXXZ
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ad1401f3dd0ee90433be3e318b633c3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

oleaut32

propsys

shlwapi

crypt32

advapi32

netapi32

oleacc

msvcrt

Exports

Exports

Sections

.text Size: 110KB - Virtual size: 110KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 5KB - Virtual size: 5KB

.detourc Size: 8KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

.rsrc Size: 1024B - Virtual size: 752B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 5KB - Virtual size: 5KB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

.rsrc
Size: 1024B - Virtual size: 752B

.reloc
Size: 1KB - Virtual size: 1KB