7f7fcb7b68688157652bc79bc9359746866af438cc31ba13c61dd996e1706159N

Sharing

Copy URL

Twitter E-mail

General

Target

7f7fcb7b68688157652bc79bc9359746866af438cc31ba13c61dd996e1706159N
Size

316KB
MD5

3d9e8a48e1ac5574d27f76da09bc4b20
SHA1

1c579c8a5be46b3c76538fd2acb46530d006dff9
SHA256

7f7fcb7b68688157652bc79bc9359746866af438cc31ba13c61dd996e1706159
SHA512

033f99eae57e095ccd788922de955c35966af388b00db1b5e50f089ed1508621080864c9787acf2927680e15e5ffe3b472372250a180992e3cc14492bd8609bf
SSDEEP

3072:HXfAzdIiRgroLK8pSJTBxF2JCYz9TTcWU5mlUgtRpnRUJl0AgXJVgIHbCK0:3YlRg8egJ5TTcWU5fyRpnRAg8IHbC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f7fcb7b68688157652bc79bc9359746866af438cc31ba13c61dd996e1706159N

Files

7f7fcb7b68688157652bc79bc9359746866af438cc31ba13c61dd996e1706159N
.dll windows:10 windows x64 arch:x64

582d9f6c59ecc9914c4862be8f81d1e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sppnp.pdb

Imports

msvcrt

_vsnwprintf
_resetstkoflw
_vsnprintf
wcsncpy_s
memmove_s
_purecall
memcpy_s
wcscpy_s
__CxxFrameHandler3
wcschr
memcmp
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
malloc
swscanf
__C_specific_handler
wcsrchr
_wcsnicmp
iswalpha
qsort
swscanf_s
_wcsicmp
toupper
memset

ntdll

RtlFreeHeap
RtlAllocateHeap
NtDeleteValueKey
NtSetValueKey
NtQueryValueKey
NtCreateKey
NtOpenKey
RtlFreeUnicodeString
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
NtSetInformationFile
NtQueryInformationFile
RtlGetVersion
NtDeleteKey
RtlFormatCurrentUserKeyPath
RtlNtStatusToDosErrorNoTeb
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
RtlInitUnicodeString
NtUnloadKeyEx
NtQuerySystemInformation
RtlInitUnicodeStringEx
NtClose
NtQueryWnfStateData
NtOpenKeyEx

user32

SetWindowPos
IsWindowVisible
GetDC
DestroyWindow
FindWindowExW
DefWindowProcW
GetMessageW
GetWindowLongW
FillRect
LoadBitmapW
CreateWindowExW
SendMessageW
GetPropW
LoadStringW
GetSystemMetrics
SetWindowTextW
SetClassLongPtrW
NotifyWinEvent
RegisterClassExW
SetThreadDesktop
ShowWindow
DispatchMessageW
SetTimer
MapWindowPoints
SetFocus
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
LoadImageW
UpdateWindow
PostQuitMessage
KillTimer
DrawTextW
GetClientRect
SetCursor
TranslateMessage
SetPropW

cfgmgr32

CM_Get_DevNode_Status
CMP_GetServerSideDeviceInstallFlags
CMP_WaitNoPendingInstallEvents
CM_MapCrToWin32Err
CM_Reenumerate_DevNode

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupUninstallOEMInfW
SetupGetInfPublishedNameW
SetupGetInfDriverStoreLocationW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiRemoveDevice
SetupDiGetDeviceInstanceIdW
SetupDiSetDeviceInstallParamsW
SetupDiGetDevicePropertyW
SetupDiCallClassInstaller
SetupVerifyInfFileW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInfoListDetailW
SetupDiGetClassDevsExW
PnpEnumDrpFile
PnpRepairWindowsProtectedDriver
pSetupInfGetDigitalSignatureInfo
pSetupInfSetDigitalSignatureInfo
pSetupInfIsInbox
pSetupFree
SetupDiGetDeviceInstallParamsW
SetupWriteTextLogError
SetupWriteTextLog
SetupSetNonInteractiveMode
SetupSetThreadLogToken
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceRegistryPropertyW
SetupGetThreadLogToken

newdev

DiInstallDevice
DiInstallDriverW

oleaut32

SysFreeString
SysAllocString

wevtapi

EvtClearLog

wdscore

WdsInitialize
WdsTerminate
WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP

drvstore

DriverStoreOpenW
DriverPackageClose
DriverStoreClose
DriverStoreFindW
DriverStoreSetLogContext
DriverStoreReflectCriticalW
DriverPackageGetVersionInfoW
DriverStoreSetObjectPropertyW
DriverStoreGetObjectPropertyW
DriverPackageOpenW
DriverStoreEnumW
DriverStoreEnumDeviceDriversW

api-ms-win-devices-query-l1-1-0

DevGetObjects
DevFreeObjects
DevSetObjectProperties

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegCreateKeyExW
RegUnLoadKeyW
RegCloseKey
RegNotifyChangeKeyValue
RegEnumKeyExW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegLoadKeyW

api-ms-win-core-processthreads-l1-1-0

QueueUserAPC
SetThreadToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
OpenProcessToken
GetExitCodeThread
CreateThread
GetCurrentThreadId
ExitProcess
CreateProcessW
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
DuplicateTokenEx
GetKernelObjectSecurity
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
IsValidSecurityDescriptor
GetSecurityDescriptorOwner

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-service-core-l1-1-2

GetServiceKeyNameW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetErrorMode
SetLastError

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
CompareStringW

api-ms-win-core-synch-l1-1-0

CreateEventW
OpenEventW
SetEvent
ReleaseMutex
CreateMutexW
WaitForSingleObjectEx
ResetEvent
SleepEx
WaitForSingleObject
WaitForMultipleObjectsEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSection
AcquireSRWLockShared
CreateMutexExW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-file-l1-1-0

CreateDirectoryW
SetEndOfFile
CreateFileW
SetFileAttributesW
GetFileInformationByHandle
SetFilePointer
FlushFileBuffers
GetFileSize
WriteFile
FileTimeToLocalFileTime
GetFullPathNameW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
CompareFileTime
GetFileAttributesW

api-ms-win-core-file-l2-1-0

MoveFileExW
CreateHardLinkW

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW
FindResourceW
MulDiv

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
LoadResource
GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
SizeofResource
LockResource

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetThreadLocale
GetLocaleInfoEx
FormatMessageW
GetLocaleInfoW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualQuery
VirtualProtect
MapViewOfFile
CreateFileMappingW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemInfo
GetTickCount64
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

GetSystemDefaultUILanguage
OutputDebugStringW
WaitForThreadpoolTimerCallbacks
IsDebuggerPresent
QueryFullProcessImageNameW
LocalFree
K32EnumProcesses
DebugBreak
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
FileTimeToSystemTime

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

gdi32

CreateFontIndirectW
SetWorldTransform
SetTextAlign
SetMapMode
TextOutW
SetBrushOrgEx
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetStockObject
GetTextAlign
DeleteDC
GetTextExtentPoint32W
SetTextColor
SetBkMode
GetObjectW
SetBkColor
SetStretchBltMode
DeleteObject
RemoveFontMemResourceEx
GdiAlphaBlend
AddFontMemResourceEx
CreateDIBitmap
GetTextMetricsW
SetGraphicsMode
SetLayout
CreateSolidBrush
GetDeviceCaps
SetTextCharacterExtra

Exports

Exports

Sysprep_Generalize_Pnp
Sysprep_Generalize_Pnp_Drivers
Sysprep_Respecialize_Pnp
Sysprep_RunDll_PnpW
Sysprep_Specialize_Offline_Pnp
Sysprep_Specialize_Pnp

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

582d9f6c59ecc9914c4862be8f81d1e4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

user32

cfgmgr32

setupapi

newdev

oleaut32

wevtapi

wdscore

drvstore

api-ms-win-devices-query-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-service-core-l1-1-2

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-profile-l1-1-0

kernel32

api-ms-win-core-com-l1-1-0

gdi32

Exports

Exports

Sections

.text Size: 208KB - Virtual size: 207KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 8KB - Virtual size: 7KB

.didat Size: 4KB - Virtual size: 24B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 440B

.text
Size: 208KB - Virtual size: 207KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 7KB

.didat
Size: 4KB - Virtual size: 24B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 440B