fea1f1018105da1d2ba258a7140036e29ecebdf63563bc5c8e87a38a75f3b69a

Sharing

Copy URL

Twitter E-mail

General

Target

fea1f1018105da1d2ba258a7140036e29ecebdf63563bc5c8e87a38a75f3b69a
Size

527KB
MD5

a0ba972b92fb3e3b90de7af16ccafb50
SHA1

fd0b427c854beedf7a75f084bf449a794ac10e50
SHA256

fea1f1018105da1d2ba258a7140036e29ecebdf63563bc5c8e87a38a75f3b69a
SHA512

4ffb92811b80fee38c247385db5acc77be58b9a45a1687bf175b854eda9d0246e22554d7d98227816aa09a81f723dbf98a8174a7be98875c94519f564d0c6428
SSDEEP

6144:GRQUWntghU/R+WtlgxTGZE7AeZ5V3Mi8oRifx/7/AOkcNlT+jOUTWolWVS/NeCcS:OUtghUkiKiZkAeZ5V3doKk+iQVsV0/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
fea1f1018105da1d2ba258a7140036e29ecebdf63563bc5c8e87a38a75f3b69a

Files

fea1f1018105da1d2ba258a7140036e29ecebdf63563bc5c8e87a38a75f3b69a
.dll regsvr32 windows:6 windows x86 arch:x86

5156a59ab3990df3dfa6c7d1aa4a974e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateEventW
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemTimeAsFileTime
GetThreadErrorMode
GetThreadLocale
GetTickCount64
GetUserDefaultLCID
GetUserDefaultLangID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsSystemResumeAutomatic
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadResource
LocalFree
MulDiv
MultiByteToWideChar
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ResetEvent
RtlUnwind
SetEvent
SetFileApisToOEM
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpiW

user32

AnyPopup
BeginPaint
CallWindowProcW
CharNextW
ClientToScreen
CloseClipboard
CountClipboardFormats
CreateWindowExW
DefWindowProcW
DestroyCaret
DestroyWindow
DrawTextW
EndPaint
GetCapture
GetClassInfoExW
GetClientRect
GetClipboardSequenceNumber
GetClipboardViewer
GetCursor
GetDC
GetDesktopWindow
GetDialogBaseUnits
GetForegroundWindow
GetKBCodePage
GetParent
GetWindowLongW
InsertMenuW
InvalidateRect
IsWindow
IsWow64Message
LoadCursorW
RegisterClassExW
ReleaseDC
SendMessageW
SetProcessDPIAware
SetTimer
SetWindowLongW
ShowWindow
UnregisterClassW

ole32

CoCreateInstance
CoFreeUnusedLibraries
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
OleRun
OleUninitialize

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarBstrCmp
VarUI4FromStr
VariantChangeType
VariantClear
VariantCopy
VariantInit

shell32

SHGetFolderPathW
ShellExecuteW

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
DeleteDC
DeleteObject
GetDeviceCaps
GetTextMetricsW
SelectObject
SetBkMode
SetTextColor

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

pdh

PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryW
PdhRemoveCounter
PdhValidatePathW

Exports

Exports

DllRegisterServer
ancoxkm
aukjbzdloqqrfv
auxigugmftnxo
bckwjikaz
brfkcbkyujc
ckywegmtkvtcsn
elhbdzyy
eqqudqkdvqjbxvpwm
fohlvkdvmeod
gqxvvcogg
gsvikwulmglmnx
hhzawgmdtivgnrp
hrjglyctdj
jtjiftl
kamblntpqpao
lfbxhsrwvlpwba
livhadbgugpgrmkn
llqsyjxgreif
lvdktzpb
maklzctblbffqy
mgslfez
mjmqxghpxxtuy
mjtlqpcodunmmph
mlqczcnaq
mlxgptnfcubup
nbngpuaatjqa
orewlovmhh
osrxgfaixqikkswgz
poebddhmoimnax
qgexrmpzczjp
rodntkgepw
srsssyflkpc
stkbxaklbarbo
tfbqsmmskqgr
tgovyvgjl
ucceuogxtdfk
ukzgouqbkdc
ulzlwsexc
uqiggweeb
vvknrlzgbut
xefrsyepkzaqscli
xhofbtlvkdai
xtgdljhnquqsmryqv
xvyinuvcntuvdb
yiaotzma
yjzjdhrjzyes
zryalwqjygd
zwmmfpp

Sections

.text
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.faxt
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 292B

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5156a59ab3990df3dfa6c7d1aa4a974e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

shell32

gdi32

advapi32

pdh

Exports

Exports

Sections

.text Size: 280KB - Virtual size: 280KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 6KB - Virtual size: 9KB

.00cfg Size: 512B - Virtual size: 4B

.faxt Size: 512B - Virtual size: 24B

.gfids Size: 512B - Virtual size: 28B

.tls Size: 512B - Virtual size: 9B

.voltbl Size: 512B - Virtual size: 292B

.rsrc Size: 144KB - Virtual size: 143KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 280KB - Virtual size: 280KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 6KB - Virtual size: 9KB

.00cfg
Size: 512B - Virtual size: 4B

.faxt
Size: 512B - Virtual size: 24B

.gfids
Size: 512B - Virtual size: 28B

.tls
Size: 512B - Virtual size: 9B

.voltbl
Size: 512B - Virtual size: 292B

.rsrc
Size: 144KB - Virtual size: 143KB

.reloc
Size: 11KB - Virtual size: 11KB