4b7e6c1c16412f74e166bec72b68c4606a40d22126775d499c903aa4709a911bN

Sharing

Copy URL Twitter E-mail

General

Target

4b7e6c1c16412f74e166bec72b68c4606a40d22126775d499c903aa4709a911bN
Size

180KB
MD5

4c018408109f692de34e549092e7fc10
SHA1

c3d42c8c639c96a2f01045e921191ded80b69afa
SHA256

4b7e6c1c16412f74e166bec72b68c4606a40d22126775d499c903aa4709a911b
SHA512

914b80e3887fb350fdc80f29ce3d5324327da14f2319b1640931dd257d76990a1180e7a7f7c4c460b200c7db49e3586e17b216584f653999ec424d06c0b76dac
SSDEEP

3072:wqsDmrT34UH3eueX8s/LnR1vqSwpNL7u2lQBV+UdE+rECWp7hKRGq54zJ:w7in3H3ZepnRXBV+UdvrEFp7hKM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b7e6c1c16412f74e166bec72b68c4606a40d22126775d499c903aa4709a911bN

Files

4b7e6c1c16412f74e166bec72b68c4606a40d22126775d499c903aa4709a911bN
.dll windows:4 windows x86 arch:x86

63f1666a383df6c6d3edc57a30e32345

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

SECITEM_ArenaDupItem
SECITEM_CopyItem
SECOID_FindOIDByTag
PORT_ArenaMark
PORT_SetError
SECOID_FindOID
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_AnyTemplate
SEC_ASN1EncodeItem
PK11_FreeSymKey
SECITEM_AllocItem
SECOID_GetAlgorithmTag
SECOID_SetAlgorithmID
SECOID_CopyAlgorithmID
PK11_GetKeyStrength
PK11_ReferenceSymKey
PK11_DestroyContext
PK11_CipherOp
PORT_Free
PK11_CreateContextBySymKey
PK11_FreeSlot
PK11_IsHW
PK11_GetSlotFromKey
PK11_GetBlockSize
SECITEM_FreeItem
PORT_ZAlloc
SECITEM_ZfreeItem
PK11_MapPBEMechanismToCryptoMechanism
PK11_ParamFromAlgid
PK11_AlgtagToMechanism
SEC_PKCS5IsAlgorithmPBEAlg
PK11_ParamToAlgid
PK11_GenerateNewParam
SEC_ASN1DecoderSetNotifyProc
SEC_ASN1DecoderStart
PORT_GetError
SEC_ASN1DecoderClearFilterProc
SEC_ASN1DecoderSetFilterProc
SEC_ASN1DecoderFinish
PORT_Alloc
SEC_ASN1DecoderUpdate
SEC_ASN1EncodeInteger
PORT_FreeArena
PORT_NewArena
SECOID_DestroyAlgorithmID
PK11_CreatePBEAlgorithmID
SEC_ASN1EncoderUpdate
SEC_ASN1EncoderSetNotifyProc
SEC_ASN1EncoderSetStreaming
SEC_ASN1EncoderStart
SEC_ASN1EncoderSetTakeFromBuf
SEC_ASN1EncoderClearNotifyProc
SEC_ASN1EncoderFinish
SEC_ASN1EncoderClearStreaming
SEC_ASN1EncoderClearTakeFromBuf
PK11_KeyGen
PK11_GetBestSlot
PK11_FindCertAndKeyByRecipientListNew
PK11_SetPasswordFunc
SECKEY_DestroyPublicKey
CERT_ExtractPublicKey
PK11_PubWrapSymKey
SECKEY_PublicKeyStrength
SECKEY_GetPublicKeyType
PK11_PubUnwrapSymKey
PK11_GetKeyLength
PK11_WrapSymKey
SECKEY_DestroyPrivateKey
PK11_PubDerive
PK11_FindKeyByAnyCert
CERT_DestroyCertificate
PK11_FindBestKEAMatch
NSS_Get_SEC_IntegerTemplate
PK11_UnwrapSymKey
PK11_MakeKEAPubKey
SEC_ASN1DecodeItem
SECKEY_DestroySubjectPublicKeyInfo
SECKEY_CopyPublicKey
CERT_GetCertIssuerAndSN
CERT_DupCertificate
SECKEY_CreateSubjectPublicKeyInfo
SEC_QuickDERDecodeItem
CERT_FindSubjectKeyIDExtension
SEC_ASN1DecodeInteger
PK11_FindPrivateKeyFromCert
SECKEY_CopyPrivateKey
CERT_DestroyCertificateList
CERT_DestroyCertList
CERT_DestroyCertArray
NSS_Get_SEC_PointerToAnyTemplate
PORT_ArenaRelease
CERT_FilterCertListByUsage
CERT_AddCertToListTail
CERT_NewCertList
CERT_ImportCerts
CERT_FindCertByDERCert
SGN_Digest
SEC_SignData
PK11_FortezzaMapSig
VFY_VerifyDigest
VFY_VerifyData
DER_DecodeTimeChoice
CERT_FindCertByIssuerAndSN
CERT_FindCertBySubjectKeyID
CERT_GetCommonName
PORT_Strdup
DER_EncodeTimeChoice
PK11_FortezzaHasKEA
CERT_SaveSMimeProfile
CERT_GetDefaultCertDB
CERT_CertListFromCert
SECOID_CompareAlgorithmID
SECITEM_ItemsAreEqual
HASH_GetHashObjectByOidTag
SECOID_FindOIDTag
CERT_FindSMimeProfile
NSS_VersionCheck
NSS_Get_sgn_DigestInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
PK11_GenerateRandom
PK11_HashBuf
PK11_DigestFinal
PK11_DigestOp
PK11_DigestBegin
SGN_CreateDigestInfo
PORT_UCS2_ASCIIConversion
SGN_DestroyDigestInfo
SECITEM_CompareItem
PORT_Realloc
PORT_UCS2_UTF8Conversion
SGN_CopyDigestInfo
DER_GetInteger
SEC_PKCS5GetKeyLength
SEC_PKCS5GetCryptoAlgorithm
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SEC_BMPStringTemplate
PK11_GetInternalSlot
PK11_ReferenceSlot
PK11_PBEKeyGen
PK11_GetInternalKeySlot
PORT_ArenaStrdup
PK11_IsInternal
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_CopyEncryptedPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
SECKEY_DestroyPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
PK11_ExportPrivateKeyInfo
__CERT_NewTempCertificate
PK11_DestroyPBEParams
PK11_CreatePBEParams
SECITEM_DupItem
SEC_ASN1DecoderClearNotifyProc
PORT_ZFree
__CERT_DecodeDERCertificate
PK11_GetTokenName
PK11_TraverseCertsForSubjectInSlot
PK11_TraverseCertsForNicknameInSlot
PK11_FindKeyByDERCert
PK11_ImportDERCert
PK11_ImportCertForKeyToSlot
CERT_IsRootDERCert
CERT_IsCADERCert
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
ATOB_ConvertAsciiToItem
ATOB_AsciiToData
PK11_RawPBEKeyGen
PK11_FindCertAndKeyByRecipientList
SEC_ASN1DecoderAbort
HASH_ResultLen
HASH_GetHashTypeByOidTag
SEC_ASN1EncoderAbort
SEC_ASN1Encode
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
CERT_VerifyCert
PORT_ArenaUnmark
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
PORT_ArenaAlloc
PORT_ArenaGrow
CERT_CertChainFromCert
PORT_ArenaZAlloc

plc4

PL_strncasecmp

nspr4

PR_Now

msvcrt

malloc
_initterm
memmove
strchr
free
_adjust_fdiv

kernel32

DisableThreadLibraryCalls

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSUtil_VerificationStatusToString
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifySignature

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63f1666a383df6c6d3edc57a30e32345

Headers

File Characteristics

Imports

nss3

plc4

nspr4

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 864B

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 864B

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 4KB - Virtual size: 2KB