38e94466715466e76f923fe13f9361fb6375c06b6de443f2283fe464654bbf14

Sharing

Copy URL Twitter E-mail

General

Target

38e94466715466e76f923fe13f9361fb6375c06b6de443f2283fe464654bbf14
Size

193KB
MD5

6d644f98083cc11c770442c4eadb434e
SHA1

b9b89d7b07c5723700b6815deb4fa3cc32d755e7
SHA256

38e94466715466e76f923fe13f9361fb6375c06b6de443f2283fe464654bbf14
SHA512

b3b99f651a41687ebe3cd9a5a506a89739805c454ba66363aca9115a6b4992029813b35a1c559008930aa85f80b6818665f90f9599ac9aaa2edc1d9496280187
SSDEEP

3072:xuz9tkQ4WGGHfZ11p0Q7V1tMWvhOSxUBHGyEygiP7VGTeSw10EHWx+5bfecbegbv:xCPb15/MWGtZ/HHWxYVAj+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38e94466715466e76f923fe13f9361fb6375c06b6de443f2283fe464654bbf14

Files

38e94466715466e76f923fe13f9361fb6375c06b6de443f2283fe464654bbf14
.dll windows:10 windows x64 arch:x64

fa8e5431597ae0e245157d09010ffbbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

rpchttp.pdb

Imports

ntdll

strtol
RtlIntegerToChar
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
TpSetPoolStackInformation
TpDisablePoolCallbackChecks
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlIntegerToUnicodeString
RtlCaptureContext
wcsrchr
wcschr
_stricmp
atoi
NtReadFile
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
memcpy
RtlReleaseSRWLockExclusive
WinSqmIsOptedIn
WinSqmIncrementDWORD
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
wcstol
DbgPrint
_strnicmp
wcsstr
wcstoul
_wcsnicmp
_itow_s
NtWriteFile
RtlRaiseException
RtlReportException
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlNtStatusToDosError
NtQuerySystemInformation
_itoa_s
__C_specific_handler
RtlInitializeSRWLock
_wcsicmp
RtlAcquireSRWLockExclusive
RtlMultiByteToUnicodeN
__chkstk
memcmp
memset

kernel32

WaitForMultipleObjects
GetComputerNameExW
RegisterWaitForSingleObject
UnregisterWait
ResolveDelayLoadedAPI
DelayLoadFailureHook
CompareFileTime
GetCurrentProcessId
WaitForSingleObjectEx
SwitchToThread
CloseThreadpool
CreateThreadpool
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CancelThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
SetThreadpoolTimer
CloseThreadpoolTimer
GetModuleHandleW
GetProcAddress
SetEvent
GetLastError
Sleep
GetCurrentProcess
TerminateProcess
CreateEventW
WaitForSingleObject
CloseHandle
ResetEvent
GetSystemTimeAsFileTime
CreateTimerQueueTimer
DeleteTimerQueueTimer
CompareStringW
GetCurrentThreadId
GlobalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThread

advapi32

RegOpenKeyExW
DeregisterEventSource
EventWriteTransfer
EventRegister
RegisterEventSourceW
ReportEventW
EventActivityIdControl
RegQueryInfoKeyW
RegEnumKeyExW
RevertToSelf
SetThreadToken
RegCloseKey
RegOpenKeyW
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
RegGetValueW
CloseServiceHandle
GetTokenInformation
OpenThreadToken
EqualSid
CopySid
GetLengthSid

secur32

GetUserNameExW

Exports

Exports

CompareHttpTransportCredentials
ConvertToUnicodeHttpTransportCredentials
DuplicateHttpTransportCredentials
FreeHttpTransportCredentials
HTTP2GetRpcConnectionTransport
HTTP2ProcessComplexTReceive
HTTP2ProcessComplexTSend
HTTP2ProcessRuntimePostedEvent
HTTP2TestHook
HttpParseNetworkOptions
HttpSendIdentifyResponse
I_RpcExtInitializeExtensionPoint
I_RpcGetRpcProxy
I_RpcProxyNewConnection
I_RpcReplyToClientWithStatus
I_RpcTransFreeHttpCredentials
I_RpcTransGetHttpCredentials
WS_HTTP2_CONNECTION__Initialize
WS_HTTP2_INITIAL_CONNECTION__new

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa8e5431597ae0e245157d09010ffbbd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

advapi32

secur32

Exports

Exports

Sections

.text Size: 159KB - Virtual size: 159KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 432B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 159KB - Virtual size: 159KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 432B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB