cfce15422bcf0fce28278b2e517741ef718de4e9f86ee8e9234805695005d018

Sharing

Copy URL Twitter E-mail

General

Target

cfce15422bcf0fce28278b2e517741ef718de4e9f86ee8e9234805695005d018
Size

276KB
MD5

d2928c16b776455405871e0faa52965f
SHA1

71ddfe6114f54cb3f110939ee38dc9559cb254d6
SHA256

cfce15422bcf0fce28278b2e517741ef718de4e9f86ee8e9234805695005d018
SHA512

b59fb89008c1d8b3ad8c951567c9a1f6e2cbc2680460601589f197f7c866aa506fd4207ea245072b74da13abb8f302bc5fc32347ef2cea527a5edbbc355a3c5e
SSDEEP

6144:HnIPFWl/92VWnmbVRktFBFsHLnoT3DSBL/J3:odC/9Arb42noT34l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfce15422bcf0fce28278b2e517741ef718de4e9f86ee8e9234805695005d018

Files

cfce15422bcf0fce28278b2e517741ef718de4e9f86ee8e9234805695005d018
.dll windows:6 windows x64 arch:x64

bc596e8952fc4c5798961941d4ac8b08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

freetype

FT_Load_Glyph
FT_Get_Postscript_Name
FT_Select_Charmap
FT_Get_Char_Index
FT_Select_Size
FT_Get_Next_Char
FT_Get_Advance
FT_Get_Sfnt_Table
FT_Done_Face
FT_Init_FreeType
FT_Set_Var_Design_Coordinates
FT_Done_MM_Var
FT_New_Face
FT_Done_FreeType
FT_Get_First_Char
FT_Get_MM_Var
FT_Get_BDF_Property
FT_Get_X11_Font_Format
FT_Get_PS_Font_Info
FT_Get_Sfnt_Name
FT_Get_Sfnt_Name_Count
FT_Load_Sfnt_Table

libexpat

ord31
ord25
ord29
ord52
ord7
ord17
ord12
ord11
ord21
ord2
ord18

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryA
GetProcAddress
GetWindowsDirectoryA
GetTempPathA
GetLongPathNameA
GetFullPathNameA
GetFileAttributesExA
GetModuleHandleA
GetLastError
FindNextFileA
FindFirstFileExA
FindClose
GetModuleFileNameA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
DeleteCriticalSection
LeaveCriticalSection
CloseHandle
InitializeCriticalSection
EnterCriticalSection

vcruntime140

memmove
memchr
memcmp
strrchr
strstr
__C_specific_handler
memset
strchr
__std_type_info_destroy_list
memcpy

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
malloc

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_chmod
_access
_rmdir
_unlink
_mkdir
rename

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_errno
_initterm
abort
_cexit
perror
strerror
_wassert
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

strtod
atoi
strtol
strtoull

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_open
_read
fflush
_get_osfhandle
_close
_write
__stdio_common_vfprintf
__stdio_common_vsscanf
fwrite
fclose
__acrt_iob_func
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strpbrk
strncat
_strdup
strcmp
isspace
isalpha
strncpy
strncmp

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

FcAtomicCreate
FcAtomicDeleteNew
FcAtomicDestroy
FcAtomicLock
FcAtomicNewFile
FcAtomicOrigFile
FcAtomicReplaceOrig
FcAtomicUnlock
FcBlanksAdd
FcBlanksCreate
FcBlanksDestroy
FcBlanksIsMember
FcCacheCopySet
FcCacheCreateTagFile
FcCacheDir
FcCacheNumFont
FcCacheNumSubdir
FcCacheSubdir
FcCharSetAddChar
FcCharSetCopy
FcCharSetCount
FcCharSetCoverage
FcCharSetCreate
FcCharSetDelChar
FcCharSetDestroy
FcCharSetEqual
FcCharSetFirstPage
FcCharSetHasChar
FcCharSetIntersect
FcCharSetIntersectCount
FcCharSetIsSubset
FcCharSetMerge
FcCharSetNew
FcCharSetNextPage
FcCharSetSubtract
FcCharSetSubtractCount
FcCharSetUnion
FcConfigAppFontAddDir
FcConfigAppFontAddFile
FcConfigAppFontClear
FcConfigBuildFonts
FcConfigCreate
FcConfigDestroy
FcConfigEnableHome
FcConfigFileInfoIterGet
FcConfigFileInfoIterInit
FcConfigFileInfoIterNext
FcConfigFilename
FcConfigGetBlanks
FcConfigGetCache
FcConfigGetCacheDirs
FcConfigGetConfigDirs
FcConfigGetConfigFiles
FcConfigGetCurrent
FcConfigGetFilename
FcConfigGetFontDirs
FcConfigGetFonts
FcConfigGetRescanInterval
FcConfigGetRescanInverval
FcConfigGetSysRoot
FcConfigHome
FcConfigParseAndLoad
FcConfigParseAndLoadFromMemory
FcConfigReference
FcConfigSetCurrent
FcConfigSetRescanInterval
FcConfigSetRescanInverval
FcConfigSetSysRoot
FcConfigSubstitute
FcConfigSubstituteWithPat
FcConfigUptoDate
FcDefaultSubstitute
FcDirCacheClean
FcDirCacheCreateUUID
FcDirCacheDeleteUUID
FcDirCacheLoad
FcDirCacheLoadFile
FcDirCacheRead
FcDirCacheRescan
FcDirCacheUnlink
FcDirCacheUnload
FcDirCacheValid
FcDirSave
FcDirScan
FcFileIsDir
FcFileScan
FcFini
FcFontList
FcFontMatch
FcFontRenderPrepare
FcFontSetAdd
FcFontSetCreate
FcFontSetDestroy
FcFontSetList
FcFontSetMatch
FcFontSetPrint
FcFontSetSort
FcFontSetSortDestroy
FcFontSort
FcFreeTypeCharIndex
FcFreeTypeCharSet
FcFreeTypeCharSetAndSpacing
FcFreeTypeQuery
FcFreeTypeQueryAll
FcFreeTypeQueryFace
FcGetDefaultLangs
FcGetLangs
FcGetVersion
FcInit
FcInitBringUptoDate
FcInitLoadConfig
FcInitLoadConfigAndFonts
FcInitReinitialize
FcLangGetCharSet
FcLangNormalize
FcLangSetAdd
FcLangSetCompare
FcLangSetContains
FcLangSetCopy
FcLangSetCreate
FcLangSetDel
FcLangSetDestroy
FcLangSetEqual
FcLangSetGetLangs
FcLangSetHasLang
FcLangSetHash
FcLangSetSubtract
FcLangSetUnion
FcMatrixCopy
FcMatrixEqual
FcMatrixMultiply
FcMatrixRotate
FcMatrixScale
FcMatrixShear
FcNameConstant
FcNameGetConstant
FcNameGetConstantFor
FcNameGetObjectType
FcNameParse
FcNameRegisterConstants
FcNameRegisterObjectTypes
FcNameUnparse
FcNameUnregisterConstants
FcNameUnregisterObjectTypes
FcObjectSetAdd
FcObjectSetBuild
FcObjectSetCreate
FcObjectSetDestroy
FcObjectSetVaBuild
FcPatternAdd
FcPatternAddBool
FcPatternAddCharSet
FcPatternAddDouble
FcPatternAddFTFace
FcPatternAddInteger
FcPatternAddLangSet
FcPatternAddMatrix
FcPatternAddRange
FcPatternAddString
FcPatternAddWeak
FcPatternBuild
FcPatternCreate
FcPatternDel
FcPatternDestroy
FcPatternDuplicate
FcPatternEqual
FcPatternEqualSubset
FcPatternFilter
FcPatternFindIter
FcPatternFormat
FcPatternGet
FcPatternGetBool
FcPatternGetCharSet
FcPatternGetDouble
FcPatternGetFTFace
FcPatternGetInteger
FcPatternGetLangSet
FcPatternGetMatrix
FcPatternGetRange
FcPatternGetString
FcPatternGetWithBinding
FcPatternHash
FcPatternIterEqual
FcPatternIterGetObject
FcPatternIterGetValue
FcPatternIterIsValid
FcPatternIterNext
FcPatternIterStart
FcPatternIterValueCount
FcPatternPrint
FcPatternReference
FcPatternRemove
FcPatternVaBuild
FcRangeCopy
FcRangeCreateDouble
FcRangeCreateInteger
FcRangeDestroy
FcRangeGetDouble
FcStrBasename
FcStrBuildFilename
FcStrCmp
FcStrCmpIgnoreCase
FcStrCopy
FcStrCopyFilename
FcStrDirname
FcStrDowncase
FcStrFree
FcStrListCreate
FcStrListDone
FcStrListFirst
FcStrListNext
FcStrPlus
FcStrSetAdd
FcStrSetAddFilename
FcStrSetCreate
FcStrSetDel
FcStrSetDestroy
FcStrSetEqual
FcStrSetMember
FcStrStr
FcStrStrIgnoreCase
FcUcs4ToUtf8
FcUtf16Len
FcUtf16ToUcs4
FcUtf8Len
FcUtf8ToUcs4
FcValueDestroy
FcValueEqual
FcValuePrint
FcValueSave
FcWeightFromOpenType
FcWeightFromOpenTypeDouble
FcWeightToOpenType
FcWeightToOpenTypeDouble

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc596e8952fc4c5798961941d4ac8b08

Headers

DLL Characteristics

File Characteristics

Imports

freetype

libexpat

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 94KB - Virtual size: 93KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 11KB - Virtual size: 10KB

.reloc Size: 1024B - Virtual size: 636B

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 94KB - Virtual size: 93KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 11KB - Virtual size: 10KB

.reloc
Size: 1024B - Virtual size: 636B