7a8f749e9cae8e70b95e23b81139173cd17aa8782c8fdc177ddc023c5190a8f2N

Sharing

Copy URL Twitter E-mail

General

Target

7a8f749e9cae8e70b95e23b81139173cd17aa8782c8fdc177ddc023c5190a8f2N
Size

935KB
MD5

da6f9b88a8b4cb8d465db0c6625096b0
SHA1

f3dd34557734ec78ff2ca0f00f4865dbf22cf8b6
SHA256

7a8f749e9cae8e70b95e23b81139173cd17aa8782c8fdc177ddc023c5190a8f2
SHA512

e38a32cd4a22542ca6fd72185fbcd7a84eb815fd5047a295ce4804ae2b73a8d0d89f83ec63f2f163c6a00b8cf8b5400de0727adff34d1e06116d9f22f388dbce
SSDEEP

24576:CQN5oj+8UK1buRQtMrPs/hnL6rf7N3YPa29fb82PAiORjDbbYWYECJ8lduhA9rNl:18UKYrXTz9rNXSfRUmO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a8f749e9cae8e70b95e23b81139173cd17aa8782c8fdc177ddc023c5190a8f2N

Files

7a8f749e9cae8e70b95e23b81139173cd17aa8782c8fdc177ddc023c5190a8f2N
.dll windows:5 windows x86 arch:x86

a69660c4cb1f07dd9abcbdd32852988e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libcef

cef_string_utf16_clear
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_v8context_get_current_context
cef_v8context_in_context
cef_string_list_copy
cef_v8value_create_function
cef_v8value_create_array
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_double
cef_v8value_create_int
cef_v8value_create_bool
cef_v8value_create_null
cef_string_map_alloc
cef_string_map_free
cef_string_list_size
cef_string_list_value
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_multimap_append
cef_string_map_append
cef_string_list_append
cef_process_message_create
cef_request_context_create_context
cef_browser_host_create_browser_sync
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_post_data_element_create
cef_request_create
cef_string_multimap_alloc
cef_string_multimap_free
cef_string_list_alloc
cef_string_list_free
cef_dictionary_value_create
cef_list_value_create
cef_string_userfree_utf16_free
cef_urlrequest_create
cef_binary_value_create
cef_post_delayed_task
cef_post_task
cef_initialize
cef_api_hash
cef_execute_process
cef_currently_on
cef_set_osmodal_loop
cef_quit_message_loop
cef_run_message_loop
cef_do_message_loop_work
cef_shutdown
cef_string_utf16_cmp
cef_string_utf8_to_utf16
cef_string_utf16_set

user32

GetWindowTextW
SetWindowTextW
IsZoomed
GetWindowLongA
GetWindowRect
SetWindowLongA
MonitorFromWindow
GetMonitorInfoA
SetWindowPos
IsWindow
SendMessageA
GetParent
DefWindowProcA
GetClientRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ReleaseDC
GetDC

python27

PyTuple_New
PyIter_Next
PyDict_Type
PyDict_Size
PyObject_GetIter
PyObject_SetItem
PyObject_DelItem
PyExc_StopIteration
PyErr_GivenExceptionMatches
PyList_Type
PyTuple_Type
PyErr_ExceptionMatches
PyErr_Clear
PyInt_FromSsize_t
PyObject_GetItem
PyTraceBack_Type
PyExc_BaseException
PyObject_Dir
PyDict_SetItem
_PyThreadState_Current
PyErr_NormalizeException
PyDict_GetItem
PyExc_SystemError
PyDict_Next
PyExc_NameError
PyErr_Format
PyTuple_Pack
PySlice_New
PyCode_New
PyObject_GC_UnTrack
PyEval_SaveThread
PyEval_RestoreThread
_Py_NoneStruct
PyErr_Occurred
PyExc_MemoryError
PyErr_SetString
PyExc_TypeError
PyExc_ValueError
PyExc_IOError
PyExc_IndexError
PyExc_OverflowError
PyExc_ArithmeticError
PyExc_RuntimeError
PyList_Append
PyObject_Call
PyDict_Contains
PySequence_Contains
PyObject_GetAttr
PyString_AsString
PyString_Type
_PyString_Eq
PyUnicodeUCS2_Compare
PyExc_UnboundLocalError
PyFloat_FromString
PyUnicode_Type
PyFloat_Type
PyCapsule_New
PyExc_ImportError
PyExc_AttributeError
PyString_FromString
PyString_InternFromString
PyDict_New
PyModule_GetDict
PyObject_GC_Track
_PyObject_GC_New
PyMem_Free
PyObject_GC_Del
PyObject_ClearWeakRefs
PyMethod_New
PyString_FromFormat
PyCFunction_Call
PyType_Ready
PyErr_NoMemory
PyMem_Malloc
PyObject_CallFunctionObjArgs
PyInt_FromLong
PyList_New
PyClass_Type
PySys_GetObject
PyString_Size
PyFile_WriteObject
PyFile_WriteString
PyFile_SoftSpace
PyLong_FromUnsignedLong
PyLong_FromLongLong
PyLong_FromUnsignedLongLong
PyErr_WarnEx
Py_GetVersion
PyOS_snprintf
PyImport_Import
PyMem_Realloc
PyTraceBack_Here
PyFrame_New
PyString_FromStringAndSize
PyUnicodeUCS2_DecodeUTF8
PyString_AsStringAndSize
PyObject_IsTrue
_Py_ZeroStruct
_Py_TrueStruct
PyNumber_Long
PyNumber_Int
PyInt_AsSsize_t
PyNumber_Index
PyInt_FromSize_t
PyObject_RichCompare
PyNumber_Remainder
PyNumber_Add
PyObject_HasAttr
PyErr_SetObject
PyExc_AssertionError
PyLong_Type
PyFloat_FromDouble
PyDict_DelItem
PyNumber_InPlaceAdd
Py_InitModule4
PyImport_AddModule
PyObject_SetAttrString
PyCFunction_NewEx
PyType_Modified
PyTuple_GetSlice
PyExc_NotImplementedError
PyLong_FromVoidPtr
PyInt_AsLong
PyCFunction_Type
PyObject_IsInstance
PyDict_Items
PyFloat_AsDouble
PyObject_Size
PyLong_AsLongLong
PyLong_AsLong
PyLong_AsUnsignedLongLong
PyLong_AsUnsignedLong
PyErr_Fetch
PyErr_WriteUnraisable
PyErr_Restore
PyCallable_Check
PyBool_Type
PyInt_Type
PyGILState_Ensure
PyGILState_Release
PyType_IsSubtype
PySequence_Tuple

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

msvcr90

memmove_s
??_V@YAXPAX@Z
calloc
malloc
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??2@YAPAXI@Z
isspace
memset
free
_CxxThrowException
memcpy
_purecall
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
__iob_func
atof
fclose
fprintf
fopen
printf
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
ceil

gdi32

GetDeviceCaps

shell32

ShellExecuteA

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetLastError
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
InterlockedExchange
Sleep
InterlockedCompareExchange
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter

Exports

Exports

App_OnBeforeCommandLineProcessing_BrowserProcess
ApplicationSettings_GetBool
ApplicationSettings_GetBoolFromDict
ApplicationSettings_GetString
BrowserProcessHandler_OnBeforeChildProcessLaunch
BrowserProcessHandler_OnRenderProcessThreadCreated
CommandLineSwitches_GetInt
CookieVisitor_Visit
DisplayHandler_OnAddressChange
DisplayHandler_OnConsoleMessage
DisplayHandler_OnStatusMessage
DisplayHandler_OnTitleChange
DisplayHandler_OnTooltip
ExecutePythonCallback
JavascriptDialogHandler_OnBeforeUnloadJavascriptDialog
JavascriptDialogHandler_OnJavascriptDialog
JavascriptDialogHandler_OnJavascriptDialogClosed
JavascriptDialogHandler_OnResetJavascriptDialogState
KeyboardHandler_OnKeyEvent
KeyboardHandler_OnPreKeyEvent
LifespanHandler_OnBeforeClose
LifespanHandler_OnBeforePopup
LoadHandler_OnLoadEnd
LoadHandler_OnLoadError
LoadHandler_OnLoadStart
LoadHandler_OnLoadingStateChange
PyBrowser_ShowDevTools
PyTaskRunnable
RemovePythonCallbacksForFrame
RenderHandler_GetRootScreenRect
RenderHandler_GetScreenInfo
RenderHandler_GetScreenPoint
RenderHandler_GetScreenRect
RenderHandler_GetViewRect
RenderHandler_OnCursorChange
RenderHandler_OnPaint
RenderHandler_OnPopupShow
RenderHandler_OnPopupSize
RenderHandler_OnScrollOffsetChanged
RequestHandler_GetAuthCredentials
RequestHandler_GetCookieManager
RequestHandler_GetResourceHandler
RequestHandler_OnBeforeBrowse
RequestHandler_OnBeforePluginLoad
RequestHandler_OnBeforeResourceLoad
RequestHandler_OnCertificateError
RequestHandler_OnPluginCrashed
RequestHandler_OnProtocolExecution
RequestHandler_OnQuotaRequest
RequestHandler_OnRendererProcessTerminated
RequestHandler_OnResourceRedirect
ResourceHandler_CanGetCookie
ResourceHandler_CanSetCookie
ResourceHandler_Cancel
ResourceHandler_GetResponseHeaders
ResourceHandler_ProcessRequest
ResourceHandler_ReadResponse
StringVisitor_Visit
V8ContextHandler_OnContextCreated
V8ContextHandler_OnContextReleased
V8FunctionHandler_Execute
WebRequestClient_OnDownloadData
WebRequestClient_OnDownloadProgress
WebRequestClient_OnRequestComplete
WebRequestClient_OnUploadProgress
cefpython_GetDebugOptions
initcefpython_py27

Sections

.text
Size: 716KB - Virtual size: 716KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a69660c4cb1f07dd9abcbdd32852988e

Headers

File Characteristics

Imports

libcef

user32

python27

msvcp90

msvcr90

gdi32

shell32

kernel32

Exports

Exports

Sections

.text Size: 716KB - Virtual size: 716KB

.rdata Size: 103KB - Virtual size: 103KB

.data Size: 51KB - Virtual size: 58KB

.rsrc Size: 1024B - Virtual size: 676B

.reloc Size: 62KB - Virtual size: 61KB

.text
Size: 716KB - Virtual size: 716KB

.rdata
Size: 103KB - Virtual size: 103KB

.data
Size: 51KB - Virtual size: 58KB

.rsrc
Size: 1024B - Virtual size: 676B

.reloc
Size: 62KB - Virtual size: 61KB