51c03732f5f4b10d5d49d9b0995c61d64910d8fc675aa2f4a072b9067eb1018d

Sharing

Copy URL Twitter E-mail

General

Target

51c03732f5f4b10d5d49d9b0995c61d64910d8fc675aa2f4a072b9067eb1018d
Size

569KB
MD5

fdb63e98546644289413246bd8d63585
SHA1

7b01d8386caccb003a5b76bb8c3de8baa6565c6b
SHA256

51c03732f5f4b10d5d49d9b0995c61d64910d8fc675aa2f4a072b9067eb1018d
SHA512

3ab9a55413f6353fa5e47d9e630fb6488e8663068a09d23bf64159fdb41cf00898213e5d881425c25c35f1ad35adcb744598ad50c3a794a44c45fb83fc5de59b
SSDEEP

6144:8r903B64Z71xtNWB8OLZLadW01ewS+8aG8aPMphxGLr:iWB64Z71XNo8O5ad5eb+8aDabr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51c03732f5f4b10d5d49d9b0995c61d64910d8fc675aa2f4a072b9067eb1018d

Files

51c03732f5f4b10d5d49d9b0995c61d64910d8fc675aa2f4a072b9067eb1018d
.dll windows:6 windows x64 arch:x64

ec50511b4e46da8b1a467667a84f8047

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sxs.pdb

Imports

ntdll

RtlVirtualUnwind
wcscpy_s
RtlLcidToLocaleName
RtlFreeUnicodeString
wcschr
RtlNtStatusToDosErrorNoTeb
wcscspn
wcsspn
wcsstr
RtlDetermineDosPathNameType_U
memmove
_vsnwprintf_s
RtlNtStatusToDosError
RtlHashUnicodeString
wcsrchr
RtlInitializeSListHead
RtlInterlockedPopEntrySList
_snprintf_s
_vsnprintf_s
RtlFindCharInUnicodeString
RtlGetFrame
swprintf_s
sprintf_s
vDbgPrintEx
NtQueryDebugFilterState
vsprintf_s
wcscat_s
RtlCompareUnicodeString
RtlUpcaseUnicodeChar
RtlDowncaseUnicodeChar
RtlRaiseStatus
DbgPrintEx
EtwEventRegister
EtwEventUnregister
EtwEventWrite
RtlCopyMappedMemory
LdrResSearchResource
_wcsicmp
RtlPushFrame
RtlPopFrame
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnhandledExceptionFilter
qsort
bsearch
_lfind
_i64tow
memcpy
memset
memcmp
__C_specific_handler
__chkstk

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-file-l1-1-0

SetFilePointerEx
ReadFile
FlushFileBuffers
GetFileInformationByHandle
CreateDirectoryW
SetFileAttributesW
DeleteFileW
RemoveDirectoryW
WriteFile
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
GetFullPathNameW
CreateFileW
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-localization-l1-1-0

GetThreadPreferredUILanguages

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-core-misc-l1-1-0

FormatMessageA
Sleep
FormatMessageW
LocalFree

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

FreeSid
AllocateAndInitializeSid
CheckTokenMembership

kernel32

AddRefActCtx
QueryActCtxW
FindActCtxSectionStringW
FindActCtxSectionGuid
DelayLoadFailureHook
DeviceIoControl
GetSystemWow64DirectoryW
LoadLibraryW
GetCurrentActCtx

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

Exports

Exports

CreateAssemblyCache
CreateAssemblyNameObject
SxsBeginAssemblyInstall
SxsEndAssemblyInstall
SxsFindClrClassInformation
SxsFindClrSurrogateInformation
SxsGenerateActivationContext
SxsInstallW
SxsLookupClrGuid
SxsOleAut32MapConfiguredClsidToReferenceClsid
SxsOleAut32MapIIDOrCLSIDToTypeLibrary
SxsOleAut32MapIIDToProxyStubCLSID
SxsOleAut32MapIIDToTLBPath
SxsOleAut32MapReferenceClsidToConfiguredClsid
SxsOleAut32RedirectTypeLibrary
SxsProbeAssemblyInstallation
SxsQueryManifestInformation
SxsRunDllInstallAssembly
SxsRunDllInstallAssemblyW
SxsUninstallW
SxspGenerateManifestPathOnAssemblyIdentity

Sections

.text
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec50511b4e46da8b1a467667a84f8047

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localization-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

kernel32

api-ms-win-core-memory-l1-1-0

Exports

Exports

Sections

.text Size: 390KB - Virtual size: 390KB

.rdata Size: 146KB - Virtual size: 145KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 16KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 390KB - Virtual size: 390KB

.rdata
Size: 146KB - Virtual size: 145KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB