ebdabe18db0faf362bf3ddb618d882b8e0ff9fec72bb65de49ef11ae1031fe63N

Sharing

Copy URL Twitter E-mail

General

Target

ebdabe18db0faf362bf3ddb618d882b8e0ff9fec72bb65de49ef11ae1031fe63N
Size

182KB
MD5

9485b3b284ed664867bca35b65197270
SHA1

89cff46dfee09026b161188aa155afaf39b4f5c2
SHA256

ebdabe18db0faf362bf3ddb618d882b8e0ff9fec72bb65de49ef11ae1031fe63
SHA512

556f41d497d640cb0736dd3096bf977e07890673e80ba43a95e6f6e1be360884e90ac9ea2c359be820ad8516fb75979163bd1b90231d475cae3e394ebc6e773a
SSDEEP

3072:BTqU5ePR64tPoUW+spGpjMYaqCfoCvKZrF3UCifH490IS4wgMAVKocTBfR+bNCXd:B+U5eJ64KUW+spGpjMYaqQoCvKIfY90t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebdabe18db0faf362bf3ddb618d882b8e0ff9fec72bb65de49ef11ae1031fe63N

Files

ebdabe18db0faf362bf3ddb618d882b8e0ff9fec72bb65de49ef11ae1031fe63N
.dll windows:4 windows x64 arch:x64

eb136462a4b06ba10f544709aafdaba1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateFileW
DeleteCriticalSection
EnterCriticalSection
FlushFileBuffers
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
GetLastError
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
PeekConsoleInputA
QueryPerformanceCounter
ReadConsoleInputA
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetFilePointer
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile

msvcrt

__doserrno
__iob_func
_amsg_exit
_errno
_filelengthi64
_fileno
_fstat64
_get_osfhandle
_initterm
_lock
_lseeki64
_stat64
_time64
_unlock
_vsnprintf
_wopen
abort
calloc
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fread
free
fseek
fsetpos
ftell
fwrite
getenv
islower
isspace
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
qsort_s
rand
realloc
rewind
signal
srand
sscanf
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strtoul
tolower
toupper
vfprintf
wcstombs
_write
_unlink
_umask
_read
_putenv
_open
_lseek
_fdopen
_close
_access

ws2_32

select

Exports

Exports

ARMT_Convert
ARM_Convert
AlignOffsetAlloc_CreateVTable
BigAlloc
BigFree
BraState_SetFromMethod
CPU_IsSupported_AES
CPU_IsSupported_PageGB
CPU_IsSupported_SHA
CPU_IsSupported_SSE41
CPU_IsSupported_SSSE3
CPU_IsSupported_VAES_AVX2
CPU_Is_InOrder
Crc64Calc
Crc64GenerateTable
Crc64Update
CrcCalc
CrcGenerateTable
CrcUpdate
CrcUpdateT1
CrcUpdateT4
CrcUpdateT8
Delta_Decode
Delta_Encode
Delta_Init
FileInStream_CreateVTable
FileOutStream_CreateVTable
FileSeqInStream_CreateVTable
File_Close
File_Construct
File_GetLength
File_Read
File_Seek
File_Write
IA64_Convert
InFile_Open
InFile_OpenW
LookInStream_LookRead
LookInStream_Read
LookInStream_Read2
LookInStream_SeekTo
LookToRead2_CreateVTable
Lzma2Dec_Allocate
Lzma2Dec_AllocateProbs
Lzma2Dec_DecodeToBuf
Lzma2Dec_DecodeToDic
Lzma2Dec_Init
Lzma2Dec_Parse
Lzma2Decode
LzmaDec_Allocate
LzmaDec_AllocateProbs
LzmaDec_DecodeToBuf
LzmaDec_DecodeToDic
LzmaDec_Free
LzmaDec_FreeProbs
LzmaDec_Init
LzmaDec_InitDicAndState
LzmaDecode
LzmaProps_Decode
MidAlloc
MidFree
MyAlloc
MyCPUID
MyFree
OutFile_Open
OutFile_OpenW
PPC_Convert
SHA256_K_ARRAY
SPARC_Convert
SecToLook_CreateVTable
SecToRead_CreateVTable
SeqInStream_Read
SeqInStream_Read2
SeqInStream_ReadByte
SetLargePageSize
Sha256Prepare
Sha256_Final
Sha256_Init
Sha256_InitState
Sha256_SetFunction
Sha256_Update
Sha256_UpdateBlocks
Sha256_UpdateBlocks_HW
XZ_SIG
XzBlock_Parse
XzBlock_ReadHeader
XzCheck_Final
XzCheck_Init
XzCheck_Update
XzCrc64UpdateT4
XzDecMtProps_Init
XzDecMt_Create
XzDecMt_Decode
XzDecMt_Destroy
XzFlags_GetCheckSize
XzStatInfo_Clear
XzUnpacker_Code
XzUnpacker_CodeFull
XzUnpacker_Construct
XzUnpacker_Free
XzUnpacker_GetExtraSize
XzUnpacker_Init
XzUnpacker_IsBlockFinished
XzUnpacker_IsStreamWasFinished
XzUnpacker_PrepareToRandomBlockDecoding
XzUnpacker_SetOutBuf
Xz_Construct
Xz_Free
Xz_GetPackSize
Xz_GetUnpackSize
Xz_ParseHeader
Xz_ReadHeader
Xz_ReadVarInt
Xz_WriteVarInt
Xzs_Construct
Xzs_Free
Xzs_GetNumBlocks
Xzs_GetUnpackSize
Xzs_ReadBackward
_dist_code
_length_code
_tr_align
_tr_flush_bits
_tr_flush_block
_tr_init
_tr_stored_block
_tr_tally
ab64_to_int
adler32
adler32_combine
adler32_combine64
adler32_z
base32_decode
base32_encode
base32_to_int
base64_decode
base64_encode
base64_to_int
base64url_to_int
bf64_to_int
call_zopen64
call_zseek64
call_ztell64
count_char
count_lines
crc32
crc32_combine
crc32_combine64
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
deflate_copyright
exec_hexify
exec_unhexify
fgetl
file_to_buffer
filename_from_filepath
fill_fopen64_filefunc
fill_fopen_filefunc
fill_zlib_filefunc64_32_def_from_filefunc32
g_AlignedAlloc
g_Alloc
g_BigAlloc
g_Crc64Table
g_CrcTable
g_CrcUpdate
g_CrcUpdateT0_32
g_CrcUpdateT0_64
g_CrcUpdateT4
g_CrcUpdateT8
g_MidAlloc
generic_salt_decode
generic_salt_encode
get_crc_table
get_entropy
get_random_num
gz_error
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
hc_asprintf
hc_bsearch_r
hc_fclose
hc_feof
hc_fflush
hc_fgetc
hc_fgets
hc_fopen
hc_fopen_raw
hc_fprintf
hc_fputc
hc_fread
hc_fscanf
hc_fseek
hc_fstat
hc_fsync
hc_ftell
hc_fwrite
hc_get_processor_count
hc_lzma1_decompress
hc_lzma2_decompress
hc_lzma_alloc
hc_lzma_free
hc_path_create
hc_path_exist
hc_path_has_bom
hc_path_is_directory
hc_path_is_empty
hc_path_is_file
hc_path_read
hc_path_write
hc_qsort_r
hc_rewind
hc_same_files
hc_strchr_last
hc_strchr_next
hc_string_bom_size
hc_string_is_digit
hc_string_trim_leading
hc_string_trim_trailing
hc_strncat
hc_strtoul
hc_strtoull
hc_vfprintf
hccalloc
hcfree
hcmalloc
hcrealloc
hcstrdup
hex_convert
hex_decode
hex_encode
hex_to_u32
hex_to_u64
hex_to_u8
in_superchop
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
inflate_copyright
inflate_fast
inflate_table
input_tokenizer
int_to_ab64
int_to_base32
int_to_base64
int_to_base64url
int_to_bf64
int_to_itoa32
int_to_itoa64
int_to_lotus64
is_hexify
is_power_of_2
is_valid_base58_char
is_valid_base58_string
is_valid_base64a_char
is_valid_base64a_string
is_valid_base64b_char
is_valid_base64b_string
is_valid_base64c_char
is_valid_base64c_string
is_valid_bech32_char
is_valid_bech32_string
is_valid_digit_char
is_valid_digit_string
is_valid_float_char
is_valid_float_string
is_valid_hex_char
is_valid_hex_string
itoa32_to_int
itoa64_to_int
lotus64_to_int
lowercase
module_attack_exec
module_dgst_pos0
module_dgst_pos1
module_dgst_pos2
module_dgst_pos3
module_dgst_size
module_esalt_size
module_hash_category
module_hash_decode
module_hash_encode
module_hash_name
module_init
module_kern_type
module_opti_type
module_opts_type
module_pw_max
module_salt_type
module_st_hash
module_st_pass
module_tmp_size
mydivc32
mydivc64
naive_escape
naive_replace
need_hexify
overflow_check_u32_add
overflow_check_u32_mul
overflow_check_u64_add
overflow_check_u64_mul
power_of_two_ceil_32
power_of_two_floor_32
round_up_multiple_32
round_up_multiple_64
select_read_timeout
select_read_timeout_console
select_write_timeout
setup_environment_variables
setup_seeding
setup_umask
sort_by_string_sized
sort_by_stringptr
strhashcategory
stroptitype
strparser
superchop_with_length
u32_to_hex
u64_to_hex
u8_to_hex
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetCurrentFileInfo64
unzGetCurrentFileZStreamPos64
unzGetFilePos
unzGetFilePos64
unzGetGlobalComment
unzGetGlobalInfo
unzGetGlobalInfo64
unzGetLocalExtrafield
unzGetOffset
unzGetOffset64
unzGoToFilePos
unzGoToFilePos64
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpen2_64
unzOpen64
unzOpenCurrentFile
unzOpenCurrentFile2
unzOpenCurrentFile3
unzOpenCurrentFilePassword
unzReadCurrentFile
unzSetOffset
unzSetOffset64
unzStringFileNameCompare
unz_copyright
unzeof
unztell
unztell64
uppercase
v16a_from_v32
v16b_from_v32
v32_from_v16ab
v32a_from_v64
v32b_from_v64
v64_from_v32ab
v8a_from_v32
v8b_from_v32
v8c_from_v32
v8d_from_v32
x86_Convert
x86cpuid_CheckAndRead
x86cpuid_GetFirm
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb136462a4b06ba10f544709aafdaba1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ws2_32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 128KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 22KB - Virtual size: 21KB

.pdata Size: 7KB - Virtual size: 6KB

.xdata Size: 5KB - Virtual size: 5KB

.bss Size: - Virtual size: 18KB

.edata Size: 11KB - Virtual size: 10KB

.idata Size: 4KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 216B

.text
Size: 128KB - Virtual size: 128KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 22KB - Virtual size: 21KB

.pdata
Size: 7KB - Virtual size: 6KB

.xdata
Size: 5KB - Virtual size: 5KB

.bss
Size: - Virtual size: 18KB

.edata
Size: 11KB - Virtual size: 10KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 216B