3f95ddf46c8125c03609b19ca7f56f5c461e60a01605619d9c4340d5795d3b16

Sharing

Copy URL Twitter E-mail

General

Target

3f95ddf46c8125c03609b19ca7f56f5c461e60a01605619d9c4340d5795d3b16
Size

1.1MB
MD5

cb92dd46445b854bec827257c2a62cce
SHA1

9daf5e69967f532a2c742dd5a6d8cd200b850824
SHA256

3f95ddf46c8125c03609b19ca7f56f5c461e60a01605619d9c4340d5795d3b16
SHA512

d5c0a1406f2de8b876af974ccd1b677004f71c8b8347dbb8476da5ac3c49c08e880ddfcfb639c668618a1046cbf64a26f1c27136fc5b4860a155a8600eda9249
SSDEEP

24576:pelU98vAQO8kYk6rsuZcGPeFmsvju/4pLDzAzJQH7:QO8Wsw+/4p847

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f95ddf46c8125c03609b19ca7f56f5c461e60a01605619d9c4340d5795d3b16

Files

3f95ddf46c8125c03609b19ca7f56f5c461e60a01605619d9c4340d5795d3b16
.dll regsvr32 windows:5 windows x86 arch:x86

2318fe7665c74f1249a6e50303d77133

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
FreeLibrary
CreateFileW
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFileSize
GetLocalTime
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DuplicateHandle
SetEvent
CreateEventW
WaitForMultipleObjects
GetTickCount
GetTempPathW
GetFileAttributesW
GetFileAttributesA
TerminateProcess
lstrcpynW
CreateDirectoryW
WTSGetActiveConsoleSessionId
VirtualAlloc
VirtualFree
VirtualProtect
IsBadReadPtr
SetLastError
LoadLibraryA
FindClose
GetSystemDirectoryW
VerSetConditionMask
SleepEx
VerifyVersionInfoW
InitializeCriticalSection
PeekNamedPipe
ReadFile
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
FormatMessageA
ResetEvent
ReadConsoleInputA
FindFirstFileA
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
FlushConsoleInputBuffer
GetModuleHandleW
GetProcAddress
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MultiByteToWideChar
lstrcatW
GetComputerNameW
CloseHandle
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
InterlockedExchange
RaiseException
GetModuleFileNameW
HeapDestroy
Sleep
InitializeCriticalSectionAndSpinCount
GetProcessHeap
InterlockedCompareExchange
HeapFree
GlobalMemoryStatus
GetModuleHandleA
LocalFree
SetEnvironmentVariableA
GetCurrentDirectoryW
WriteConsoleW
SystemTimeToTzSpecificLocalTime
SetConsoleMode
GetDriveTypeW
FindFirstFileExW
SetStdHandle
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
ReadConsoleW
GetConsoleMode
SetConsoleCtrlHandler
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapAlloc
HeapReAlloc
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
GetFullPathNameW
IsProcessorFeaturePresent
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCommandLineA
AreFileApisANSI
GetModuleHandleExW
ExitProcess
LoadLibraryExW
ExitThread
CreateThread
GetStringTypeW
EncodePointer
OutputDebugStringW
IsDebuggerPresent

user32

PostMessageW
PeekMessageW
TranslateMessage
wsprintfW
DispatchMessageW
CreateWindowExW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
DefWindowProcW
GetWindowLongW
DestroyWindow
GetMessageW
SetWindowLongW

advapi32

RegisterEventSourceA
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RevertToSelf
ImpersonateLoggedOnUser
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ReportEventA
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
RegDeleteKeyW
DeregisterEventSource

shell32

SHGetSpecialFolderPathW

ole32

IIDFromString
CoInitializeSecurity
CoCreateGuid
CoCreateInstance
CoUninitialize
CoTaskMemFree
StringFromIID
CoInitializeEx

oleaut32

SysAllocString
VariantInit
VariantClear
SysFreeString

shlwapi

PathAddBackslashW
PathAppendW
StrCmpNIW

iphlpapi

GetIpForwardTable
GetAdaptersInfo

wldap32

ord216
ord26
ord41
ord127
ord118
ord14
ord79
ord145
ord208
ord167
ord147
ord27
ord301
ord46
ord142
ord133

wtsapi32

WTSQueryUserToken

ws2_32

WSACleanup
WSAStartup
getsockopt
closesocket
WSASetLastError
ntohs
bind
recv
setsockopt
getsockname
gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
send
select
__WSAFDIsSet
getpeername
WSAIoctl
connect
WSAGetLastError
htons
socket

Exports

Exports

CallTaskFun
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 877KB - Virtual size: 877KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2318fe7665c74f1249a6e50303d77133

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

wldap32

wtsapi32

ws2_32

Exports

Exports

Sections

.text Size: 877KB - Virtual size: 877KB

.rdata Size: 224KB - Virtual size: 223KB

.data Size: 11KB - Virtual size: 27KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 877KB - Virtual size: 877KB

.rdata
Size: 224KB - Virtual size: 223KB

.data
Size: 11KB - Virtual size: 27KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 39KB - Virtual size: 39KB