d814c29837be2faa20b2b7450cb30afb2af430a2e86fb5f94f5a9764cbe39fe6

Sharing

Copy URL Twitter E-mail

General

Target

d814c29837be2faa20b2b7450cb30afb2af430a2e86fb5f94f5a9764cbe39fe6
Size

229KB
MD5

3150697838ec780c99611d653419a02d
SHA1

b592efed719b64bcc5648a1cac09a4e11e4e9520
SHA256

d814c29837be2faa20b2b7450cb30afb2af430a2e86fb5f94f5a9764cbe39fe6
SHA512

7006e4aaf1deea810200c056389863fc5d1de4ec6359deb8c62c4a913f0a0f3c1b7dc6e254ec1bca6e81b8c8c05ef9bb6b4658f86b6ec15f9ab10ebc9d7ef431
SSDEEP

3072:amkHdE+02qRIGYrP6OUHgz5dHtSyXQTxaxz2lJE2cWUQlaQMpjlaFKcF5:aJdDkcP6Oygz5dNVQizgyRjsFF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d814c29837be2faa20b2b7450cb30afb2af430a2e86fb5f94f5a9764cbe39fe6

Files

d814c29837be2faa20b2b7450cb30afb2af430a2e86fb5f94f5a9764cbe39fe6
.dll windows:5 windows x64 arch:x64

567e2d70224143a0962eeb9ddad02d2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

ntohl
htonl
htons
WSAStringToAddressW
freeaddrinfo
getaddrinfo
WSADuplicateSocketA
WSAGetLastError
WSAStartup
gethostbyname
socket
setsockopt
send
select
recv
listen
inet_ntoa
inet_addr
connect
closesocket
bind
accept

crypt32

CertGetCertificateContextProperty
CryptDecodeObjectEx
CryptImportPublicKeyInfo

wininet

InternetOpenW
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetSetOptionW
InternetConnectW
InternetCrackUrlW

winhttp

WinHttpOpen
WinHttpQueryOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpConnect
WinHttpReadData
WinHttpCrackUrl

kernel32

FindFirstFileExA
FindClose
GetStringTypeW
LCMapStringW
GetFileType
GetStdHandle
GetACP
HeapReAlloc
HeapAlloc
HeapFree
GetModuleFileNameA
GetModuleHandleExW
TerminateProcess
VirtualAllocEx
OpenProcess
GetCurrentProcess
GetLastError
WriteProcessMemory
CloseHandle
DuplicateHandle
CreateEventW
FreeLibrary
GetProcAddress
VirtualAlloc
VirtualFree
OpenThread
SetLastError
SuspendThread
ResumeThread
Sleep
LoadLibraryA
GetVersionExW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
FindNextFileA
VirtualProtect
VirtualQuery
LoadLibraryW
GetModuleHandleA
VirtualProtectEx
ExitProcess
SetUnhandledExceptionFilter
CreateRemoteThread
ExitThread
GetSystemTime
SystemTimeToFileTime
GetModuleHandleW
LocalFree
WriteFile
GetSystemDirectoryW
CreateFileA
GetVolumeInformationW
GetComputerNameW
GetThreadId
WaitForMultipleObjects
LocalAlloc
GetOverlappedResult
ResetEvent
ReadFile
ConnectNamedPipe
CreateNamedPipeA
GetCurrentProcessId
GetCurrentThreadId
SetHandleInformation
SetNamedPipeHandleState
PeekNamedPipe
CreateFileW
CreateNamedPipeW
CreateThread
GetTickCount
GlobalFree
TerminateThread
SetEvent
ReleaseMutex
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
RaiseException
LoadLibraryExW
TlsFree
TlsSetValue
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
TlsGetValue
TlsAlloc
FlushInstructionCache
CreateMutexW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

user32

GetProcessWindowStation
GetUserObjectInformationA
GetThreadDesktop

advapi32

CryptImportKey
ImpersonateLoggedOnUser
OpenProcessToken
OpenThreadToken
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
AllocateAndInitializeSid
CryptDuplicateKey
CryptDecrypt
CryptEncrypt
AdjustTokenPrivileges
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
LookupPrivilegeValueW

ole32

CoCreateGuid

dnsapi

DnsQuery_W
DnsFree

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

567e2d70224143a0962eeb9ddad02d2e

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wininet

winhttp

kernel32

user32

advapi32

ole32

dnsapi

Sections

.text Size: 152KB - Virtual size: 152KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 12KB - Virtual size: 26KB

.pdata Size: 8KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 152KB - Virtual size: 152KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 12KB - Virtual size: 26KB

.pdata
Size: 8KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 1KB