5cbc98ebeff0fe7553e2b2f05e60156779a70860e03309def00172741aa1685e

Sharing

Copy URL Twitter E-mail

General

Target

5cbc98ebeff0fe7553e2b2f05e60156779a70860e03309def00172741aa1685e
Size

5.1MB
MD5

d44ae0de2a86c1ebc53e4bd50e0ba977
SHA1

c319b6ca33c1d5b9d86dc2bac2a856df35f180c6
SHA256

5cbc98ebeff0fe7553e2b2f05e60156779a70860e03309def00172741aa1685e
SHA512

50c30c7f86a51afc58df6fd304aea042f166df443f0a802ccf91446968c27d29c57a8eb17a727f9a1d171452702a99b768a41565a839693b29deb02f218b4743
SSDEEP

98304:PcQjCT/lYvihlNS1b3/oJctrB46Xd48edDD2vtewrv/79uYSmYlGI1:Pc4s/lYvalI1bw0d46Ram//8aYn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cbc98ebeff0fe7553e2b2f05e60156779a70860e03309def00172741aa1685e

Files

5cbc98ebeff0fe7553e2b2f05e60156779a70860e03309def00172741aa1685e
.dll windows:5 windows x64 arch:x64

48f94947041d16e8d3a772769e6c43fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetTempPathW
CreateDirectoryW
CreateFileW
DeleteFileW
GetTickCount
GetVersionExW
WTSGetActiveConsoleSessionId
CreateEventW
CloseHandle
DeviceIoControl
ReadFile
WriteFile
WaitForSingleObject
CreateThread
TerminateProcess
GetCurrentProcess
GetProcAddress
FreeLibrary
LoadLibraryW
GetModuleFileNameW
Sleep
MoveFileExW
SetUnhandledExceptionFilter
OutputDebugStringW
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
SetFilePointerEx
GetFileType
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
GetStringTypeW
CompareStringW
LCMapStringW
FlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExW
RegEnumKeyExW
CreateProcessAsUserW
SetServiceStatus
RegisterServiceCtrlHandlerW
RegQueryValueExW
RegOpenKeyW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegOpenKeyExA

shell32

SHFileOperationW

shlwapi

SHDeleteKeyW
PathAppendW
PathFileExistsW
SHGetValueA
SHSetValueA

wtsapi32

WTSQueryUserToken
WTSSendMessageW

wininet

InternetConnectW
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetOpenW
InternetCloseHandle

bcrypt

BCryptDeriveKeyPBKDF2
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptFinishHash

user32

GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

ServiceMain
cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_Version
cJSON_free
cJSON_malloc

Sections

.text
Size: 282KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

W0
Size: 2.7MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

W1
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 957B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48f94947041d16e8d3a772769e6c43fd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

wtsapi32

wininet

bcrypt

user32

Exports

Exports

Sections

.text Size: 282KB - Virtual size: 284KB

.rdata Size: 81KB - Virtual size: 84KB

.data Size: 17KB - Virtual size: 20KB

.pdata Size: 13KB - Virtual size: 16KB

W0 Size: 2.7MB - Virtual size: 2.8MB

W1 Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 3KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 957B

.text
Size: 282KB - Virtual size: 284KB

.rdata
Size: 81KB - Virtual size: 84KB

.data
Size: 17KB - Virtual size: 20KB

.pdata
Size: 13KB - Virtual size: 16KB

W0
Size: 2.7MB - Virtual size: 2.8MB

W1
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 957B