bd66c9b13336507efb003c6ef3d1e002b3e5d9a57f9879ed01e99c01bd835404

Sharing

Copy URL

Twitter E-mail

General

Target

bd66c9b13336507efb003c6ef3d1e002b3e5d9a57f9879ed01e99c01bd835404
Size

524KB
MD5

e1a126fc5902f8f275495484875a6227
SHA1

004b141fe27e8db9f61248b454a7ad287d7bede0
SHA256

bd66c9b13336507efb003c6ef3d1e002b3e5d9a57f9879ed01e99c01bd835404
SHA512

3a9aa01a29bf92d90140c9b0385531c216dcd666d530ec56d8b2597e9fd6c13928368195edf0c9b6edec87de98913e8629550912222265bce10b0faf8a72ac24
SSDEEP

12288:F4UuFuNB2bvR0Iva6qREvKMHBK8i/Da7VpxmIXf5:FriuNsVC6qsi/g5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
bd66c9b13336507efb003c6ef3d1e002b3e5d9a57f9879ed01e99c01bd835404

Files

bd66c9b13336507efb003c6ef3d1e002b3e5d9a57f9879ed01e99c01bd835404
.dll regsvr32 windows:6 windows x86 arch:x86

42b6eb59ab89b7c7191018703e14d098

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateEventW
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileSizeEx
GetFileType
GetLargePageMinimum
GetLastError
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetThreadUILanguage
GetTickCount64
GetTickCount
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadResource
LocalFree
MulDiv
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ResetEvent
RtlUnwind
SetEvent
SetFileApisToOEM
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnregisterApplicationRestart
VirtualAlloc
VirtualFree
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpiW

user32

BeginPaint
CallWindowProcW
CharNextW
ClientToScreen
CreateWindowExW
DefWindowProcW
DestroyWindow
DrawTextW
EndPaint
GetActiveWindow
GetClassInfoExW
GetClientRect
GetClipboardSequenceNumber
GetDC
GetFocus
GetKBCodePage
GetMenuCheckMarkDimensions
GetParent
GetShellWindow
GetWindowLongW
InSendMessage
InsertMenuW
InvalidateRect
IsProcessDPIAware
IsWindow
IsWow64Message
LoadCursorW
RegisterClassExW
ReleaseDC
SendMessageW
SetProcessDPIAware
SetTimer
SetWindowLongW
ShowWindow
UnregisterClassW

ole32

CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
OleRun

shell32

InitNetworkAddressControl
SHGetFolderPathW
ShellExecuteW

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarBstrCmp
VarUI4FromStr
VariantChangeType
VariantClear
VariantCopy
VariantInit

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
DeleteDC
DeleteObject
GetDeviceCaps
GetTextMetricsW
SelectObject
SetBkMode
SetTextColor

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

pdh

PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryW
PdhRemoveCounter
PdhValidatePathW

Exports

Exports

DllRegisterServer
austckxfaik
cqqkeex
djnqbtvayy
efrzyvglli
enubqhyhrdravak
eyrdtwullrvwzgb
fgflgbcpnp
folzognykxruci
fsupufzxveidd
gpguvkjhe
gukhufeydga
jeeeevt
jxjyvymfmz
kjojhkittpozqpd
lmtrwlpwqtjhvtuj
macttvghbgxroesg
nsxooyrzrlhro
oqrmsstke
ouzshlkyftkltocd
purxbfgweot
qdxgdfho
scadjlmnhpakucfx
somnqlvfnxrkqhj
sssbflczmpglj
stiqygspmrq
ttbuqyelb
tvbisaovmjg
ueeusdvsyjicm
uhgvaac
vdawmye
veuaqnc
vrzxzuprpdqaqj
vsunefeo
wniyallto
wvwypnbgbav
xevcabapuc
xsprevqng
ygpmmpsimcpicgirh
zhpuiokrty

Sections

.text
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.faxt
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 1024B - Virtual size: 641B

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42b6eb59ab89b7c7191018703e14d098

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

shell32

oleaut32

gdi32

advapi32

pdh

Exports

Exports

Sections

.text Size: 272KB - Virtual size: 272KB

.rdata Size: 86KB - Virtual size: 86KB

.data Size: 5KB - Virtual size: 9KB

.00cfg Size: 512B - Virtual size: 4B

.faxt Size: 512B - Virtual size: 28B

.gfids Size: 512B - Virtual size: 8B

.tls Size: 512B - Virtual size: 9B

.voltbl Size: 1024B - Virtual size: 641B

.rsrc Size: 144KB - Virtual size: 143KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 272KB - Virtual size: 272KB

.rdata
Size: 86KB - Virtual size: 86KB

.data
Size: 5KB - Virtual size: 9KB

.00cfg
Size: 512B - Virtual size: 4B

.faxt
Size: 512B - Virtual size: 28B

.gfids
Size: 512B - Virtual size: 8B

.tls
Size: 512B - Virtual size: 9B

.voltbl
Size: 1024B - Virtual size: 641B

.rsrc
Size: 144KB - Virtual size: 143KB

.reloc
Size: 11KB - Virtual size: 11KB