64126a00cccd570fb517c9b9d485e45128f4fe8adcdb39a80993acb73a3ae378

Sharing

Copy URL Twitter E-mail

General

Target

64126a00cccd570fb517c9b9d485e45128f4fe8adcdb39a80993acb73a3ae378
Size

367KB
MD5

5121fc3baf18b9c2d59deda962d94285
SHA1

0507ad43acd13c46f541b0db800ca686f0bc0a3d
SHA256

64126a00cccd570fb517c9b9d485e45128f4fe8adcdb39a80993acb73a3ae378
SHA512

33ad64d2a1699bd02c9fbe0d80ce5c5978a6a4705a876ec1dcc1eec9ed719da936b6a72d2bffbd77523c1b028bade1bf545f6b90229d079a7668f979edbd1463
SSDEEP

6144:8VK0eZD8OkbrtMEV2Vr7a/NH2z05rGAms2UCU7WiKZq/nMOz05HzxFvptRuT8XzX:8VK0eNUr+EElu/EzmuQMTDrMLdvod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64126a00cccd570fb517c9b9d485e45128f4fe8adcdb39a80993acb73a3ae378

Files

64126a00cccd570fb517c9b9d485e45128f4fe8adcdb39a80993acb73a3ae378
.dll windows:6 windows x64 arch:x64

e6a27579c85fe3c1b5918376f53d94cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

gdiplus

GdiplusStartup
GdipGetImageHeight
GdipCloneImage
GdipBitmapUnlockBits
GdipDeleteBrush
GdipAlloc
GdipDisposeImage
GdipCreateSolidFill
GdipFree
GdipBitmapLockBits
GdipCloneBrush
GdipGetImageGraphicsContext
GdipFillRectangleI
GdipDeleteGraphics
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI

kernel32

CreateMutexA
WaitForSingleObject
CreateFileW
GetCurrentThreadId
ReleaseMutex
HeapSize
MultiByteToWideChar
GetLastError
DeleteFileW
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
GetLocalTime
DecodePointer
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
GetSystemTimeAsFileTime
GetFileTime
FileTimeToDosDateTime
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetSystemDirectoryW
OpenProcess
SetEvent
LoadLibraryW
ResetEvent
GetProcAddress
GetModuleHandleW
FreeLibrary
GetFileSizeEx
GetCurrentProcess
GetModuleFileNameW
GetProcessId
GetTempPathW
CreateMutexW
UnmapViewOfFile
CreateToolhelp32Snapshot
FindClose
Process32NextW
OutputDebugStringW
LoadLibraryA
Process32FirstW
CreateFileMappingW
MapViewOfFile
LocalAlloc
CreateEventW
LocalFree
WriteProcessMemory
SetLastError
GetNativeSystemInfo
VirtualAllocEx
FlushInstructionCache
CreateRemoteThread
ExitThread
GetModuleHandleA
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
EnumSystemLocalesW
GetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetModuleHandleExW
ExitProcess
GetFileAttributesExW
GetTimeZoneInformation
CreateDirectoryW
ReadFile
InterlockedFlushSList
LoadLibraryExW
InitializeCriticalSectionEx
OutputDebugStringA
FindNextFileW
HeapFree
FindFirstFileW
GetModuleFileNameA
GetACP
FlushFileBuffers
WriteFile
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
SetEndOfFile
GetExitCodeThread
RtlUnwindEx
RtlPcToFileHeader
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent

user32

SystemParametersInfoW
DefWindowProcW
DestroyWindow
GetPropW
SetWindowLongPtrW
CreateWindowExW
MsgWaitForMultipleObjects
RegisterClassExW
DispatchMessageW
PeekMessageW
ChangeWindowMessageFilter
SetPropW
TranslateMessage
UpdateWindow
InvalidateRect
FindWindowExW
SendMessageW
UnregisterClassW
PostQuitMessage

advapi32

CreateWellKnownSid
SetSecurityInfo
BuildTrusteeWithSidW
GetSecurityInfo
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
SetEntriesInAclW

shell32

CommandLineToArgvW

shlwapi

PathFileExistsA
PathFileExistsW
wnsprintfW

Exports

Exports

Loader
SunMainLoader
dwm_thunk_entry

Sections

.text
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6a27579c85fe3c1b5918376f53d94cd

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

user32

advapi32

shell32

shlwapi

Exports

Exports

Sections

.text Size: 233KB - Virtual size: 233KB

.rdata Size: 107KB - Virtual size: 106KB

.data Size: 6KB - Virtual size: 14KB

.pdata Size: 12KB - Virtual size: 12KB

.gfids Size: 512B - Virtual size: 496B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 233KB - Virtual size: 233KB

.rdata
Size: 107KB - Virtual size: 106KB

.data
Size: 6KB - Virtual size: 14KB

.pdata
Size: 12KB - Virtual size: 12KB

.gfids
Size: 512B - Virtual size: 496B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 3KB