6887b28b864df539582c817b68c9ceac40dcad6dcc61a461f79eaab3bfe8ec9c

Sharing

Copy URL

Twitter E-mail

General

Target

6887b28b864df539582c817b68c9ceac40dcad6dcc61a461f79eaab3bfe8ec9c
Size

3.5MB
MD5

550e00c2b3c02940f8dececd27d3468c
SHA1

43f21090c8e4719012d8051c247bccb0e83d6bcc
SHA256

6887b28b864df539582c817b68c9ceac40dcad6dcc61a461f79eaab3bfe8ec9c
SHA512

63d78dad4974da96bf7034eb8979b02641ad8d9c441d32e2b1afe61540f9b9c3f384ee4cdf278cf10387fda6b3500cafaf6094a7b39930c19573fdee407c6c6f
SSDEEP

49152:X91zHyHQvbLVFx4alPSfyqqVuuPXbbd+94pbP3luqBr9og7+RQBgi5oft7fkVM:3zDogKwgCoftgu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6887b28b864df539582c817b68c9ceac40dcad6dcc61a461f79eaab3bfe8ec9c

Files

6887b28b864df539582c817b68c9ceac40dcad6dcc61a461f79eaab3bfe8ec9c
.dll windows:6 windows x64 arch:x64

347fc58f45fec285cbd6bd275b889bf5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

AcquireSRWLockExclusive
AreFileApisANSI
CheckRemoteDebuggerPresent
CloseHandle
CompareStringW
CreateDirectoryA
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateRemoteThread
CreateRemoteThreadEx
CreateThread
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetProcessId
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadId
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GlobalMemoryStatus
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapWalk
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32EnumDeviceDrivers
K32EnumProcesses
K32GetDeviceDriverBaseNameA
K32GetDeviceDriverFileNameA
K32GetModuleFileNameExA
K32GetModuleInformation
K32GetProcessImageFileNameA
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OpenProcess
OpenThread
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleInputW
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseSRWLockExclusive
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetStdHandle
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WinExec
WriteConsoleW
WriteFile

user32

BeginPaint
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EndPaint
FillRect
FindWindowA
FindWindowExA
GetClassNameA
GetClientRect
GetDC
GetMessageW
GetProcessWindowStation
GetRawInputDeviceInfoW
GetRawInputDeviceList
GetSystemMetrics
GetUserObjectInformationW
GetWindow
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InvalidateRect
MessageBoxA
MessageBoxW
PostQuitMessage
RegisterClassW
SetWindowPos
ShowWindow
TranslateMessage
UpdateWindow

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreatePatternBrush
CreateSolidBrush
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject
SetBrushOrgEx
SetStretchBltMode

ole32

CreateStreamOnHGlobal

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
DeregisterEventSource
FreeSid
GetSecurityInfo
GetTokenInformation
GetUserNameA
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
LookupPrivilegeValueA
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceW
ReportEventW
RevertToSelf
SetEntriesInAclA
SetSecurityDescriptorDacl
SetSecurityInfo

ntdll

LdrLoadDll
NtAdjustPrivilegesToken
NtAlertResumeThread
NtClose
NtCreateFile
NtCreateThread
NtCreateThreadEx
NtDuplicateToken
NtOpenProcessToken
NtProtectVirtualMemory
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVirtualMemory
NtSetInformationProcess
NtSetInformationThread
NtSuspendThread
NtTerminateProcess
NtTerminateThread
RtlCreateUserThread
RtlImageNtHeader
ZwQuerySystemInformation

iphlpapi

GetAdaptersInfo
GetTcpTable2

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
closesocket
gethostbyname
getpeername
htons
inet_addr
inet_ntoa
ntohl
ntohs
recvfrom
select
sendto
socket

dxgi

CreateDXGIFactory

shlwapi

PathAppendA
PathRemoveFileSpecA

dbghelp

ImageRvaToVa

gdiplus

GdipAlloc
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdiplusShutdown
GdiplusStartup

Exports

Exports

JNI_OnLoad
Java_dimension_DimensionAPI_addSelfFrom
Java_dimension_DimensionAPI_appendTasks
Java_dimension_DimensionAPI_calculate
Java_dimension_DimensionAPI_closeSource
Java_dimension_DimensionAPI_createTempBitMap
Java_dimension_DimensionAPI_deleteCache
Java_dimension_DimensionAPI_exitCalculate
Java_dimension_DimensionAPI_freeThreadPool
Java_dimension_DimensionAPI_getHuzpsbPY
Java_dimension_DimensionAPI_getMyLastError
Java_dimension_DimensionAPI_getMyLocaleInfo
Java_dimension_DimensionAPI_getPoolState
Java_dimension_DimensionAPI_getVeroFessPY
Java_dimension_DimensionAPI_initialThreadPool
Java_dimension_DimensionAPI_isValid
Java_dimension_DimensionAPI_moveSelfTo
Java_dimension_DimensionAPI_validate

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 455KB - Virtual size: 501KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 58B

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

347fc58f45fec285cbd6bd275b889bf5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

advapi32

ntdll

iphlpapi

ws2_32

dxgi

shlwapi

dbghelp

gdiplus

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 455KB - Virtual size: 501KB

.pdata Size: 63KB - Virtual size: 63KB

.00cfg Size: 512B - Virtual size: 40B

.tls Size: 512B - Virtual size: 9B

.voltbl Size: 512B - Virtual size: 58B

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 512B - Virtual size: 424B

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 455KB - Virtual size: 501KB

.pdata
Size: 63KB - Virtual size: 63KB

.00cfg
Size: 512B - Virtual size: 40B

.tls
Size: 512B - Virtual size: 9B

.voltbl
Size: 512B - Virtual size: 58B

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 512B - Virtual size: 424B

.reloc
Size: 67KB - Virtual size: 67KB