c1b81ff59d2f58f7fb6c5a66d83291007bb2e8aef8a659477813273751c4708c

Sharing

Copy URL

Twitter E-mail

General

Target

c1b81ff59d2f58f7fb6c5a66d83291007bb2e8aef8a659477813273751c4708c
Size

412KB
MD5

5bbb327eec0858096e9d7d2e02bcdd21
SHA1

d4118794177211f35548911dea5eaee37f4732a6
SHA256

c1b81ff59d2f58f7fb6c5a66d83291007bb2e8aef8a659477813273751c4708c
SHA512

e7a10f671a469f21bce00c66cce32e800316cafd16f86329dea841071a71d70c3799788e0439d14b0870766ed4e65c9c42adb2cf9488669d1fd38e180bf19c7c
SSDEEP

6144:xLl7XgCt3z4QktK8zm+pTf3l6sn2ocEKya5VRCE5KjazSvs4U4FWANhqT8Argj:3bgCOvt9zmufX2ocL5qE8aOvZFQ4RA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
c1b81ff59d2f58f7fb6c5a66d83291007bb2e8aef8a659477813273751c4708c

Files

c1b81ff59d2f58f7fb6c5a66d83291007bb2e8aef8a659477813273751c4708c
.dll regsvr32 windows:4 windows x86 arch:x86

740550e6f2a46f2a05a2cc82f9117d3f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
GetFileTime
GetTickCount
RtlUnwind
GetSystemInfo
GetCommandLineA
ExitProcess
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
GlobalFlags
WritePrivateProfileStringA
FileTimeToSystemTime
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GlobalGetAtomNameA
GlobalFindAtomA
lstrcatA
lstrcmpW
FreeResource
GlobalAddAtomA
GetCurrentThread
GetCurrentThreadId
GlobalDeleteAtom
lstrcmpA
GetModuleFileNameA
GetModuleHandleA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
InterlockedDecrement
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpynA
LocalFree
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
MultiByteToWideChar
FindResourceW
GetNativeSystemInfo
HeapAlloc
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapFree
FreeLibrary
GetProcAddress
LoadLibraryA
IsBadReadPtr
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualProtect
SetLastError
VirtualAlloc
VirtualFree
VirtualQuery
CreatePipe
CreateProcessA
PeekNamedPipe
ReadFile
WaitForSingleObject
Sleep
TerminateProcess
CloseHandle
GetLastError
FreeEnvironmentStringsA
FormatMessageA

user32

PostThreadMessageA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
wsprintfA
DestroyMenu
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsChild
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
DefWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetWindowContextHelpId
MapDialogRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetNextDlgTabItem
EndDialog
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetMenuItemBitmaps
SendMessageA
PeekMessageA
ShowWindow
DrawIcon
AppendMenuA
EnableMenuItem
GetSystemMenu
IsIconic
GetClientRect
EnableWindow
LoadIconA
GetSystemMetrics
ModifyMenuA
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
MessageBoxA
RegisterClipboardFormatA
GetLastActivePopup
SetCursor
PostQuitMessage
PostMessageA
GetWindowTextLengthA
GetWindowTextA
GetFocus
GetParent
SetWindowPos
SetFocus
CallWindowProcA
CharUpperA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
GetDlgItem
SendDlgItemMessageA
IsDialogMessageA
GetWindowLongA
SetWindowTextA
GetDlgCtrlID
SetWindowLongA
MoveWindow
IsWindowEnabled

gdi32

CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
CreateFontA
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetObjectA
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
SelectObject

comdlg32

GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StgCreateDocfileOnILockBytes
CoTaskMemFree
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoTaskMemAlloc
OleInitialize

oleaut32

SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
SysAllocString
OleCreateFontIndirect

Exports

Exports

DllRegisterServer

Sections

.text
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

740550e6f2a46f2a05a2cc82f9117d3f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 164KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 152KB - Virtual size: 149KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 168KB - Virtual size: 164KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 152KB - Virtual size: 149KB

.reloc
Size: 32KB - Virtual size: 31KB