e5b268178e386da452edd59d3c7ed709d0cc5e34bec1afbaa36288bfa6d85453

Sharing

Copy URL

Twitter E-mail

General

Target

e5b268178e386da452edd59d3c7ed709d0cc5e34bec1afbaa36288bfa6d85453
Size

862KB
MD5

cb79761eddee1b2086d6df27f07ec2a8
SHA1

14b23b461fad4fa7886bb453d89fb7a39f372cd0
SHA256

e5b268178e386da452edd59d3c7ed709d0cc5e34bec1afbaa36288bfa6d85453
SHA512

f967f96053facb7fe1519b3111cecc9bf0100888da61410b6da4c900da6670026192ffa4e9a4031c9a94a93179caf8dd0c83b32e5925d9adc730c50a85071019
SSDEEP

24576:HPgKOqjVmV6xblEPV9PAsoWg2qi+YKYIP4J+H:Yq6d9PAsoFM+YIAJ+H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e5b268178e386da452edd59d3c7ed709d0cc5e34bec1afbaa36288bfa6d85453

Files

e5b268178e386da452edd59d3c7ed709d0cc5e34bec1afbaa36288bfa6d85453
.dll windows:6 windows x86 arch:x86

29f3eeaf0de850e2113b27b4ddbc0def

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\code\clean_master\1\webwrap\webwrap\Release\webwrap.pdb

Imports

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdiplusStartup

kernel32

CreateFileW
FlushFileBuffers
WriteFile
WaitForSingleObject
OpenProcess
lstrlenW
GetCurrentThreadId
LoadLibraryExW
lstrcmpW
SetLastError
SetEvent
CreateEventW
WaitForMultipleObjects
SetFileAttributesW
SetFileTime
RaiseException
DecodePointer
GetTickCount
CreateThread
Sleep
WideCharToMultiByte
MoveFileW
CopyFileW
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
lstrcmpA
DeviceIoControl
FreeResource
GetVersionExW
GetSystemWindowsDirectoryW
WriteConsoleW
FreeLibrary
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
FindResourceExW
GetSystemDirectoryW
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileW
RtlUnwind
GetFileSize
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
QueryDosDeviceW
GetLongPathNameW
SetFilePointer
GetLogicalDriveStringsW
WritePrivateProfileStringW
GetPrivateProfileStringW
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
ReadFile
FindClose
DeleteFileW
CreateDirectoryW
MultiByteToWideChar
SetEnvironmentVariableW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSizeEx
CreateMutexW
ReleaseMutex
GetCurrentProcessId
LocalFree
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue

user32

IsWindowVisible
IsWindow
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
PostMessageW
SendMessageW
SetWindowPos
LoadCursorW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DispatchMessageW
TranslateMessage
SystemParametersInfoW
GetClassNameW
EnumWindows
FindWindowExW
SetParent
GetParent
LoadImageW
LoadIconW
SetClassLongW
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
SetWindowTextW
InvalidateRect
SetForegroundWindow
GetForegroundWindow
KillTimer
SetTimer
ReleaseCapture
SetFocus
IsZoomed
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyWindow
CallWindowProcW
PostQuitMessage
DefWindowProcW
wsprintfW
UpdateLayeredWindow
BeginPaint
EndPaint
SetWindowRgn
EqualRect
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetDesktopWindow
EnumDisplaySettingsW
RegisterClassW
AttachThreadInput
GetWindowThreadProcessId
GetShellWindow
ReleaseDC
GetDC
GetActiveWindow
GetWindowPlacement
ShowWindow
UnregisterClassW
PostThreadMessageW
PeekMessageW
GetMessageW
MonitorFromRect
FindWindowW
OffsetRect
CopyRect

gdi32

CreateCompatibleBitmap
CombineRgn
BitBlt
CreateRectRgn
DeleteObject
SelectObject
SetViewportOrgEx
DeleteDC
GetDeviceCaps
SetBkColor
ExtTextOutW
CreateCompatibleDC

comdlg32

CommDlgExtendedError
GetSaveFileNameW

advapi32

RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
MapGenericMask
GetFileSecurityW
DuplicateToken
AccessCheck
RegGetValueW

shell32

SHBrowseForFolderW
SHGetSpecialFolderPathW
ord165
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteW
SHChangeNotify
SHCreateDirectoryExW
SHGetPropertyStoreForWindow

ole32

CoTaskMemFree
CoCreateInstance
CoCreateGuid
CreateStreamOnHGlobal
PropVariantClear
CoInitialize
CoUninitialize
CoTaskMemAlloc

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathIsRootW
StrCmpIW
SHGetValueW
PathIsDirectoryW
PathIsRelativeW
SHSetValueW
StrStrIA
StrStrIW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathAppendW
AssocQueryStringW
StrCmpNIW
StrTrimA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

Exports

Exports

GetWebWindowFactory
GetWebWindowFactoryEx
GetWebWindowFactoryV3

Sections

.text
Size: 663KB - Virtual size: 662KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29f3eeaf0de850e2113b27b4ddbc0def

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wintrust

crypt32

wininet

iphlpapi

urlmon

Exports

Exports

Sections

.text Size: 663KB - Virtual size: 662KB

.rdata Size: 147KB - Virtual size: 146KB

.data Size: 16KB - Virtual size: 21KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 663KB - Virtual size: 662KB

.rdata
Size: 147KB - Virtual size: 146KB

.data
Size: 16KB - Virtual size: 21KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 32KB - Virtual size: 31KB