345682429730c2ba1f89560436a9c75a901a523614b72bf1e21c92df34458a5f

Sharing

Copy URL Twitter E-mail

General

Target

345682429730c2ba1f89560436a9c75a901a523614b72bf1e21c92df34458a5f
Size

751KB
MD5

930083f47793937d59672860f895c5e6
SHA1

40202f730a9d71879b3dfda617593e934857daae
SHA256

345682429730c2ba1f89560436a9c75a901a523614b72bf1e21c92df34458a5f
SHA512

03fc6161daad987fb11a1d9979a489a6523276ed9d9025e500f44037a5b668ee4c1ad7b3d20375c52ceda14614ce3deb44c4cace20cd61c0971888af9b9a4423
SSDEEP

12288:kvtOQznoJ7eon7PsoPFx2LRN/VnDECRq4Svwbx7geZ3K57ZHB/NmGdL07:kFnoJ72RVlE43nx75Z65JvmGL0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
345682429730c2ba1f89560436a9c75a901a523614b72bf1e21c92df34458a5f

Files

345682429730c2ba1f89560436a9c75a901a523614b72bf1e21c92df34458a5f
.dll windows:6 windows x86 arch:x86

b54c4e3c1297aa83fcda6e6178373285

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\code\clean_master\1\webwrap\webwrap\Release\webwrap.pdb

Imports

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdiplusStartup

kernel32

CreateFileW
FlushFileBuffers
WriteFile
WaitForSingleObject
OpenProcess
lstrlenW
GetCurrentThreadId
LoadLibraryExW
lstrcmpW
SetLastError
SetEvent
CreateEventW
WaitForMultipleObjects
SetFileTime
RaiseException
DecodePointer
GetTickCount
CreateThread
Sleep
WideCharToMultiByte
MultiByteToWideChar
MoveFileW
CopyFileW
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetSystemDirectoryW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextFileW
ExitThread
InterlockedFlushSList
RtlUnwind
GetFileSize
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32GetProcessImageFileNameW
SetFilePointer
K32GetModuleFileNameExW
QueryDosDeviceW
GetLongPathNameW
GetLogicalDriveStringsW
WritePrivateProfileStringW
GetPrivateProfileStringW
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalFree
GlobalUnlock
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
SetFileAttributesW
GlobalLock
GlobalAlloc
GetTempPathW
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSizeEx
CreateMutexW
ReleaseMutex
GetCurrentProcessId
LocalFree
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
GetCPInfo
FormatMessageW
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW

user32

IsWindow
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
SetWindowPos
LoadCursorW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DispatchMessageW
TranslateMessage
SystemParametersInfoW
GetClassNameW
EnumWindows
FindWindowExW
SetParent
GetParent
LoadImageW
LoadIconW
PostMessageW
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
SetWindowTextW
InvalidateRect
SetForegroundWindow
GetForegroundWindow
KillTimer
SetTimer
ReleaseCapture
SetFocus
IsZoomed
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyWindow
wsprintfW
UpdateLayeredWindow
BeginPaint
EndPaint
SetWindowRgn
EqualRect
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetDesktopWindow
EnumDisplaySettingsW
RegisterClassW
CallWindowProcW
PostQuitMessage
DefWindowProcW
AttachThreadInput
GetWindowThreadProcessId
GetShellWindow
ReleaseDC
GetDC
GetActiveWindow
GetWindowPlacement
ShowWindow
UnregisterClassW
PostThreadMessageW
PeekMessageW
GetMessageW
MonitorFromRect
FindWindowW
OffsetRect
CopyRect
SendMessageW
SetClassLongW
IsWindowVisible

gdi32

CreateCompatibleDC
DeleteObject
SelectObject
SetViewportOrgEx
CreateCompatibleBitmap
CombineRgn
BitBlt
DeleteDC
GetDeviceCaps
SetBkColor
CreateRectRgn
ExtTextOutW

comdlg32

CommDlgExtendedError
GetSaveFileNameW

advapi32

RegGetValueW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
MapGenericMask
GetFileSecurityW
DuplicateToken
AccessCheck
OpenProcessToken

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
SHGetPropertyStoreForWindow
SHChangeNotify
ord165
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoUninitialize
CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathIsDirectoryW
StrStrIW
PathIsRootW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathAppendW
SHGetValueW
SHSetValueW
AssocQueryStringW
PathIsRelativeW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

Exports

Exports

GetWebWindowFactory
GetWebWindowFactoryEx
GetWebWindowFactoryV3

Sections

.text
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b54c4e3c1297aa83fcda6e6178373285

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wintrust

crypt32

Exports

Exports

Sections

.text Size: 573KB - Virtual size: 572KB

.rdata Size: 131KB - Virtual size: 130KB

.data Size: 15KB - Virtual size: 20KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 573KB - Virtual size: 572KB

.rdata
Size: 131KB - Virtual size: 130KB

.data
Size: 15KB - Virtual size: 20KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 28KB - Virtual size: 27KB