95142dd124e732388684d79e589c18a00fe55eda2af3cd055c3bd5cc6feb2760

Sharing

Copy URL

Twitter E-mail

General

Target

95142dd124e732388684d79e589c18a00fe55eda2af3cd055c3bd5cc6feb2760
Size

944KB
MD5

e1fd15726c61a16219286f808457b005
SHA1

118a7309e85d4594e91bd5fb791dce4e84ff1e9c
SHA256

95142dd124e732388684d79e589c18a00fe55eda2af3cd055c3bd5cc6feb2760
SHA512

075b89e73badb35bbe48f78e910ba5cb270548cbccb40491647b4ffd5b232883eb528c0a53f57d031e392bb77a336b8e1bba20f8b03c4efd87b7c668a9a7fe72
SSDEEP

12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
95142dd124e732388684d79e589c18a00fe55eda2af3cd055c3bd5cc6feb2760

Files

95142dd124e732388684d79e589c18a00fe55eda2af3cd055c3bd5cc6feb2760
.dll windows:5 windows x64 arch:x64

8d681d21965c4762199ac2bb118f7c17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrTrimW
UrlUnescapeA

wintrust

CryptCATPutAttrInfo

kernel32

UnregisterWaitEx
EnumTimeFormatsA
GetNLSVersion
GetLastError
CloseHandle
SetEvent
FindActCtxSectionStringW

wininet

GetUrlCacheEntryInfoW

setupapi

SetupLogErrorA
SetupDiSetSelectedDriverA

mscms

AssociateColorProfileWithDeviceW

msvcrt

ldiv
isdigit

rpcrt4

UuidIsNil
RpcBindingSetAuthInfoExA
NdrUserMarshalUnmarshall

oleaut32

VarDateFromCy
VarR8FromDec

ole32

HICON_UserMarshal

mprapi

MprAdminInterfaceTransportAdd

gdi32

CopyEnhMetaFileW
CreateMetaFileW
CreateDiscardableBitmap
SetWindowExtEx
GetRegionData
DeleteColorSpace

netapi32

NetShareGetInfo

Exports

Exports

LogonIdFromWinStationNameA
LogonIdFromWinStationNameW
RemoteAssistancePrepareSystemRestore
ServerGetInternetConnectorStatus
ServerLicensingClose
ServerLicensingDeactivateCurrentPolicy
ServerLicensingFreePolicyInformation
ServerLicensingGetAadInfo
ServerLicensingGetAvailablePolicyIds
ServerLicensingGetPolicy
ServerLicensingGetPolicyInformationA
ServerLicensingGetPolicyInformationW
ServerLicensingLoadPolicy
ServerLicensingOpenA
ServerLicensingOpenW
ServerLicensingSetAadInfo
ServerLicensingSetPolicy
ServerLicensingUnloadPolicy
ServerQueryInetConnectorInformationA
ServerQueryInetConnectorInformationW
ServerSetInternetConnectorStatus
WTSRegisterSessionNotificationEx
WTSUnRegisterSessionNotificationEx
WinStationActivateLicense
WinStationAutoReconnect
WinStationBroadcastSystemMessage
WinStationCheckAccess
WinStationCheckLoopBack
WinStationCloseServer
WinStationConnectA
WinStationConnectAndLockDesktop
WinStationConnectCallback
WinStationConnectEx
WinStationConnectW
WinStationConsumeCacheSession
WinStationCreateChildSessionTransport
WinStationDisconnect
WinStationEnableChildSessions
WinStationEnumerateA
WinStationEnumerateContainerSessions
WinStationEnumerateExW
WinStationEnumerateLicenses
WinStationEnumerateProcesses
WinStationEnumerateW
WinStationEnumerate_IndexedA
WinStationEnumerate_IndexedW
WinStationFreeConsoleNotification
WinStationFreeEXECENVDATAEX
WinStationFreeGAPMemory
WinStationFreeMemory
WinStationFreePropertyValue
WinStationFreeUserCertificates
WinStationFreeUserCredentials
WinStationFreeUserSessionInfo
WinStationGenerateLicense
WinStationGetAllProcesses
WinStationGetAllSessionsEx
WinStationGetAllSessionsW
WinStationGetAllUserSessions
WinStationGetChildSessionId
WinStationGetConnectionProperty
WinStationGetCurrentSessionCapabilities
WinStationGetCurrentSessionConnectionProperty
WinStationGetCurrentSessionTerminalName
WinStationGetDeviceId
WinStationGetInitialApplication
WinStationGetLanAdapterNameA
WinStationGetLanAdapterNameW
WinStationGetLastWinlogonNotification
WinStationGetLoggedOnCount
WinStationGetMachinePolicy
WinStationGetParentSessionId
WinStationGetProcessSid
WinStationGetRedirectAuthInfo
WinStationGetRestrictedLogonInfo
WinStationGetSessionIds
WinStationGetTermSrvCountersValue
WinStationGetUserCertificates
WinStationGetUserCredentials
WinStationGetUserProfile
WinStationInstallLicense
WinStationIsBoundToCacheTerminal
WinStationIsChildSessionsEnabled
WinStationIsCurrentSessionRemoteable
WinStationIsHelpAssistantSession
WinStationIsSessionPermitted
WinStationIsSessionRemoteable
WinStationNameFromLogonIdA
WinStationNameFromLogonIdW
WinStationNegotiateSession
WinStationNtsdDebug
WinStationOpenServerA
WinStationOpenServerExA
WinStationOpenServerExW
WinStationOpenServerW
WinStationPreCreateGlassReplacementSession
WinStationPreCreateGlassReplacementSessionEx
WinStationQueryAllowConcurrentConnections
WinStationQueryCurrentSessionInformation
WinStationQueryEnforcementCore
WinStationQueryInformationA
WinStationQueryInformationW
WinStationQueryLicense
WinStationQueryLogonCredentialsW
WinStationQuerySessionVirtualIP
WinStationQueryUpdateRequired
WinStationRcmShadow2
WinStationRedirectErrorMessage
WinStationRedirectLogonBeginPainting
WinStationRedirectLogonError
WinStationRedirectLogonMessage
WinStationRedirectLogonStatus
WinStationRegisterConsoleNotification
WinStationRegisterConsoleNotificationEx
WinStationRegisterConsoleNotificationEx2
WinStationRegisterCurrentSessionNotificationEvent
WinStationRegisterNotificationEvent
WinStationRemoveLicense
WinStationRenameA
WinStationRenameW
WinStationReportLoggedOnCompleted
WinStationReportUIResult
WinStationReset
WinStationRevertFromServicesSession
WinStationSendMessageA
WinStationSendMessageW
WinStationSendWindowMessage
WinStationServerPing
WinStationSetAutologonPassword
WinStationSetInformationA
WinStationSetInformationW
WinStationSetLastWinlogonNotification
WinStationSetPoolCount
WinStationSetRenderHint
WinStationShadow
WinStationShadowAccessCheck
WinStationShadowStop
WinStationShadowStop2
WinStationShutdownSystem
WinStationSwitchToServicesSession
WinStationSystemShutdownStarted
WinStationSystemShutdownWait
WinStationTerminateGlassReplacementSession
WinStationTerminateProcess
WinStationUnRegisterConsoleNotification
WinStationUnRegisterNotificationEvent
WinStationUserLoginAccessCheck
WinStationVerify
WinStationVirtualOpen
WinStationVirtualOpenEx
WinStationWaitSystemEvent
_NWLogonQueryAdmin
_NWLogonSetAdmin
_WinStationAnnoyancePopup
_WinStationBeepOpen
_WinStationBreakPoint
_WinStationCallback
_WinStationCheckForApplicationName
_WinStationFUSCanRemoteUserDisconnect
_WinStationGetApplicationInfo
_WinStationNotifyDisconnectPipe
_WinStationNotifyLogoff
_WinStationNotifyLogon
_WinStationNotifyNewSession
_WinStationOpenSessionDirectory
_WinStationReInitializeSecurity
_WinStationReadRegistry
_WinStationSessionInitialized
_WinStationShadowTarget
_WinStationShadowTarget2
_WinStationShadowTargetSetup
_WinStationUpdateClientCachedCredentials
_WinStationUpdateSettings
_WinStationUpdateUserConfig
_WinStationWaitForConnect

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 628KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d681d21965c4762199ac2bb118f7c17

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

wintrust

kernel32

wininet

setupapi

mscms

msvcrt

rpcrt4

oleaut32

ole32

mprapi

gdi32

netapi32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 126KB

.rdata Size: 628KB - Virtual size: 624KB

.data Size: 112KB - Virtual size: 111KB

.pdata Size: 4KB - Virtual size: 1KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 32KB - Virtual size: 30KB

.reloc Size: 12KB - Virtual size: 9KB

Size: 4KB - Virtual size: 503B

Size: 4KB - Virtual size: 503B

Size: 8KB - Virtual size: 6KB

.text
Size: 128KB - Virtual size: 126KB

.rdata
Size: 628KB - Virtual size: 624KB

.data
Size: 112KB - Virtual size: 111KB

.pdata
Size: 4KB - Virtual size: 1KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 32KB - Virtual size: 30KB

.reloc
Size: 12KB - Virtual size: 9KB