0435e8f147d1617f15955d744033e6160440ba95da3e069768d0ee641a731882N

Sharing

Copy URL Twitter E-mail

General

Target

0435e8f147d1617f15955d744033e6160440ba95da3e069768d0ee641a731882N
Size

1.5MB
MD5

a743100820b372c79075e0c53ec69c80
SHA1

050633331aa004f2b4994fd53888fe1dfe87f0db
SHA256

0435e8f147d1617f15955d744033e6160440ba95da3e069768d0ee641a731882
SHA512

f5c20501cb6b4d00a4117d9051cbf41fce2833de32fe981adaf685ece149533687bb587a03fb5a7b62ed792f69632c5df7b36202b4b7728d638bd85736eebe67
SSDEEP

12288:CDuFOSV24vcbMlXYxc5B/jTKT4NUTFN5qPl2uoUmGrWftqz6V99wdqIukt4:CDuP24vcbQOc59jTKEsvkt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0435e8f147d1617f15955d744033e6160440ba95da3e069768d0ee641a731882N

Files

0435e8f147d1617f15955d744033e6160440ba95da3e069768d0ee641a731882N
.dll regsvr32 windows:10 windows x64 arch:x64

c6f55a72f09b23c27b0bbf2e9d795295

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Windows.Networking.Vpn.pdb

Imports

msvcrt

memmove
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
??0exception@@QEAA@AEBQEBDH@Z
_initterm
__C_specific_handler
?what@exception@@UEBAPEBDXZ
_lock
_unlock
toupper
_onexit
__CxxFrameHandler3
??1type_info@@UEAA@XZ
wcscspn
memset
memcmp
memcpy
log10
__RTDynamicCast
swprintf_s
?terminate@@YAXXZ
??0exception@@QEAA@AEBQEBD@Z
wcstok
_wcsicmp
_wtoi
realloc
free
malloc
??_V@YAXPEAX@Z
memmove_s
_purecall
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
__dllonexit
wcscmp

ntdll

RtlLengthSid
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlIsStateSeparationEnabled
RtlNtStatusToDosError
RtlCopySid
EtwTraceMessage
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlFreeSid
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
RtlEqualSid

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
ResetEvent
InitializeSRWLock
AcquireSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ReleaseSemaphore
ReleaseSRWLockShared
LeaveCriticalSection
WaitForSingleObjectEx
CreateEventExW
WaitForSingleObject
CreateEventW
OpenSemaphoreW
EnterCriticalSection
ReleaseMutex
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
OpenProcessToken
TerminateProcess
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
SetThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsSubstringWithSpecifiedLength
HSTRING_UserUnmarshal64
WindowsCreateString
WindowsCreateStringReference
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
HSTRING_UserFree
WindowsDeleteString
HSTRING_UserSize64
WindowsDuplicateString
WindowsIsStringEmpty
WindowsGetStringRawBuffer
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserFree64
WindowsSubstring
WindowsGetStringLen
WindowsConcatString

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
RoOriginateError
GetRestrictedErrorInfo

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstanceEx
CoUninitialize
CoInitializeEx
StringFromGUID2
CoCreateGuid
CoRevertToSelf
CoImpersonateClient
CoCreateInstance
CoGetApartmentType
CoMarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc

bcrypt

BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventProviderEnabled
EventWriteTransfer
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoActivateInstance
RoInitialize

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetAce
GetTokenInformation
RevertToSelf

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
CompareStringW

crypt32

CertGetCertificateContextProperty
CertFindCertificateInStore
CryptAcquireCertificatePrivateKey
CertSetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CryptFindOIDInfo
CertOpenStore

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient21
ObjectStublessClient17
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient18
ObjectStublessClient3
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
ObjectStublessClient14
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient15
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient12
NdrProxyForwardingFunction4

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetSecurityInfo

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

cryptsp

CryptHashData
CryptSetProvParam
CryptReleaseContext
CryptDestroyHash
CryptSignHashW
CryptCreateHash

fwpolicyiomgr

FwEmptyWFRule

api-ms-win-appmodel-state-l1-2-0

CloseState
GetStateFolder
OpenStateExplicitForUserSidString

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFamilyName

api-ms-win-appmodel-runtime-l1-1-1

VerifyPackageFamilyName

api-ms-win-rtcore-ntuser-window-l1-1-0

AllowSetForegroundWindow

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
LaunchStoreForPluginW
VpnClientGetCostedNetworkSettings
VpnClientGetProxyForUrlAndSingleSessionDeviceUser
VpnClientPluginGetSecurity
VpnClientPluginInstall
VpnClientPluginManifestFind
VpnClientPluginUninstall
VpnClientSetCostedNetworkSettings
VpnPluginEnumerate
VpnPluginListFree

Sections

.text
Size: 689KB - Virtual size: 689KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 548KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 179KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6f55a72f09b23c27b0bbf2e9d795295

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-winrt-robuffer-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-com-l1-1-0

bcrypt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

crypt32

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cryptsp

fwpolicyiomgr

api-ms-win-appmodel-state-l1-2-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 689KB - Virtual size: 689KB

.rdata Size: 548KB - Virtual size: 547KB

.data Size: 179KB - Virtual size: 186KB

.pdata Size: 24KB - Virtual size: 24KB

.didat Size: 1024B - Virtual size: 912B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 689KB - Virtual size: 689KB

.rdata
Size: 548KB - Virtual size: 547KB

.data
Size: 179KB - Virtual size: 186KB

.pdata
Size: 24KB - Virtual size: 24KB

.didat
Size: 1024B - Virtual size: 912B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 32KB - Virtual size: 32KB