861c6909b3937b67c6a9871372632e865da84f4ed3ea7093c3fccee114989cb7N

Sharing

Copy URL Twitter E-mail

General

Target

861c6909b3937b67c6a9871372632e865da84f4ed3ea7093c3fccee114989cb7N
Size

181KB
MD5

788791729f586af82eb71b36867c3d00
SHA1

84074444c909bf57ce584dbef6cfbb032f08c799
SHA256

861c6909b3937b67c6a9871372632e865da84f4ed3ea7093c3fccee114989cb7
SHA512

02e7d6bb718d49cffc1545de60c980278a4351f619e2658634caba4e5fb8645941e1fe19009d2a403341b03900cb72eaed564b2eecaee1705bb4f84015f0c2ba
SSDEEP

3072:qgX/N7LYLafbQDt0Kv7id80+jZhfPgDk2lQBV+UdE+rECWp7hKjvch:HXhbM0iWd83j38CBV+UdvrEFp7hKjch

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
861c6909b3937b67c6a9871372632e865da84f4ed3ea7093c3fccee114989cb7N

Files

861c6909b3937b67c6a9871372632e865da84f4ed3ea7093c3fccee114989cb7N
.dll windows:4 windows x86 arch:x86

65f4542b68dc4d92fa9c7ddc33806afa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStringTypeA
LCMapStringA
GetStringTypeW
LCMapStringW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
CloseHandle
SetFilePointer
lstrcpyA
lstrlenA
GlobalAlloc
MulDiv
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalHandle
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
VirtualFree
HeapCreate
WriteFile
GlobalFree
EnterCriticalSection
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
FreeEnvironmentStringsW
MultiByteToWideChar
FreeEnvironmentStringsA
GetOEMCP
RtlUnwind
RaiseException
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetEnvironmentStrings
GetACP
TerminateProcess
HeapAlloc
LeaveCriticalSection
ExitProcess
HeapFree
SetUnhandledExceptionFilter
GetModuleFileNameA
GetCPInfo
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA

user32

FillRect
DrawTextA
LoadCursorA
SetCursor
LoadBitmapA
PtInRect
IsWindow
CopyRect
UnionRect
OffsetRect
IsRectEmpty
InvalidateRect
InvalidateRgn
GetClientRect
IntersectRect
SetRectEmpty
InflateRect

gdi32

CreateRectRgnIndirect
SelectObject
SetBkColor
CreateDIBSection
SetTextColor
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
CreatePolygonRgn
PtInRegion
Rectangle
Polygon
CreatePatternBrush
SetPolyFillMode
CreateCompatibleDC
SetWindowOrgEx
CreateDCA
CreateRectRgn
MoveToEx
DeleteDC
SetRectRgn
CreatePen
LineTo
SetBkMode
Ellipse
SetROP2
PatBlt
IntersectClipRect
ExcludeClipRect
GetRgnBox
DeleteObject
CombineRgn
SetBrushOrgEx
GetStockObject
UnrealizeObject
GetClipBox

stwa

?Copy@WA@@SAHAAV1@PAUtagPOINT@@01HHH@Z
?GetAddress@WABAND@@QBEPAEXZ
??0WA@@QAE@ABV0@@Z
??0WA@@QAE@HHHPAD@Z
?GetPixel@WAPIX@@QAEHHHPAD00@Z
?GetAccessToRow@WAPIX@@QAEPAEH@Z
??3WAPIX@@SAXPAX@Z
??0WAPIX@@QAE@PAVWA@@H@Z
??2Stwa_nd@@SAPAXI@Z
??1WAPIX@@QAE@XZ
??1WABAND@@QAE@XZ
?GetInfo@WA@@QBEHPAUWAINFO@@@Z
??0WABAND@@QAE@PAVWA@@HHG@Z
??3Stwa_nd@@SAXPAX@Z
?GetBandSize@WA@@QBEHXZ
??1WA@@QAE@XZ

stxform

??0XFFACT@@QAE@JJJJ@Z
?RevXForm@STXFORM@@QBEXAAUtagPOINT@@H@Z
?XForm@STXFORM@@QBEXAAUtagRECT@@H@Z
?RevXForm@STXFORM@@QBEXAAUtagRECT@@H@Z

Exports

Exports

AddPointToPolygonFrg
AddToComplexFrg
ChangeFrgBound
CreateComplexFrg
CreateEllipticFrg
CreateEmptyFrg
CreateEmptyMask
CreateFragmentIndirect
CreateLineFrg
CreateMaskCopyWA
CreateMaskIndirect
CreateMaskUsingWA
CreatePolygonFrg
CreateRectFrg
CreateTextFrg
DeleteFragment
DeleteFrgBound
DeletePolygonFrgLastPoint
EndSmoothEdge
EqualPMRect
FreeFrgBoundPrivateData
FrgInternalDataChanged
GetComplexFrgItem
GetComplexFrgItemNum
GetComplexFrgMask
GetDistanceToEdges
GetFragmentBoundRect
GetFragmentNumber
GetFragmentType
GetFrgBoundMethodFlags
GetLineBeginPoint
GetLineEndPoint
GetLineStyle
GetLineWidth
GetMaskRect
GetMaskWA
GetPolygonFrgArray
GetPolygonFrgFillMode
GetPolygonFrgSize
GetSmoothEdge
GetTextFrgFont
GetTextFrgText
GetTextFrgTextLength
InitSmoothEdge
IntersectPMRect
IsFrgInverted
OffsetPMRect
PMRectToRect
PaintFrgBound
PointInFragment
PutFragmentToMask
RectToPMRect
SetFragmentOriginPoint
SetFrgInversion
SetPMRectEmpty
SetPolygonFrgFillMode
ShareFragment
UnionPMRect

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65f4542b68dc4d92fa9c7ddc33806afa

Headers

File Characteristics

Imports

kernel32

user32

gdi32

stwa

stxform

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 15KB - Virtual size: 22KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 192B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 15KB - Virtual size: 22KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 192B

.reloc
Size: 6KB - Virtual size: 5KB