fac9dc2fc81d69cd54102a80e95b18d352fb1c42af429c6942747b548ee1f2ef

Sharing

Copy URL

Twitter E-mail

General

Target

fac9dc2fc81d69cd54102a80e95b18d352fb1c42af429c6942747b548ee1f2ef
Size

359KB
MD5

8990f3968a0afb0e9bb5973308d765cf
SHA1

4e52e4ea16c61cae91764bc4874e037a75561275
SHA256

fac9dc2fc81d69cd54102a80e95b18d352fb1c42af429c6942747b548ee1f2ef
SHA512

7c635d7e7f8af70b594fed10ccce2f227806c4447fbe646047a442a3bff5e3bae1197855e38ef4af3c8572300aa956e05f02ced5191e572b64e41a798470fc4f
SSDEEP

6144:uf8Adcb3wxhYfMDailLKxkPCxphbDCEAaX19QFKFCPO0lOzA+w9fQd:uEAdcbs4bGKK4QFmG5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fac9dc2fc81d69cd54102a80e95b18d352fb1c42af429c6942747b548ee1f2ef

Files

fac9dc2fc81d69cd54102a80e95b18d352fb1c42af429c6942747b548ee1f2ef
.dll regsvr32 windows:5 windows x86 arch:x86

31f9764109fc10779607dc47d4f67963

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
free
_vsnprintf
_except_handler3
rand
wcsncpy
wcscmp
_wcsicmp
wcstok
_wcsnicmp
_wtoi
_purecall
wcslen
wcscpy
wcsncmp
_ltoa
sprintf
wcsstr
wcscat
isalpha
iscntrl
isspace
time
wcschr
isdigit
memchr
isxdigit

shlwapi

StrStrW
StrCmpW
StrCmpNIW
StrCpyNW
StrStrIA
StrCmpIW
StrChrA
StrStrA
ord342
ord151
SHGetValueA
StrToIntA
StrCmpNIA
StrNCatA
StrRChrA
UrlCombineA
UrlCanonicalizeA
ord153
UrlUnescapeA

advapi32

RegOpenKeyA
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
GetUserNameA
RegOpenKeyExW
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegCreateKeyExA
OpenThreadToken
RevertToSelf
SetThreadToken
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueA

kernel32

SetEndOfFile
WriteFile
GlobalMemoryStatus
RaiseException
FlushFileBuffers
ReleaseSemaphore
CreateSemaphoreA
VirtualAlloc
VirtualFree
GetComputerNameA
DeviceIoControl
GlobalSize
CompareFileTime
LoadLibraryW
OutputDebugStringA
SetErrorMode
SetFilePointer
GetSystemTime
GetTickCount
Sleep
PostQueuedCompletionStatus
WaitForMultipleObjects
GetSystemInfo
CreateIoCompletionPort
CreateThread
GetQueuedCompletionStatus
FreeLibraryAndExitThread
InterlockedIncrement
InterlockedCompareExchange
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
lstrcpynA
GetCurrentProcessId
CreateFileA
ResetEvent
SetEvent
GetExitCodeThread
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
RtlMoveMemory
lstrcmpA
GetModuleHandleA
FormatMessageW
GlobalUnlock
IsBadStringPtrA
IsProcessorFeaturePresent
GetDateFormatA
IsBadCodePtr
MultiByteToWideChar
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
lstrcatA
lstrcpyA
InterlockedExchange
GetVersionExA
GlobalFree
SetLastError
IsBadWritePtr
IsBadStringPtrW
IsBadReadPtr
WideCharToMultiByte
lstrlenW
GetLastError
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
lstrcmpiA
CreateEventA
CloseHandle
GetCurrentThread
TlsSetValue
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsFree
GlobalAlloc
GetCurrentProcess
CreateMutexA
ReleaseMutex
WaitForSingleObject
IsDBCSLeadByteEx
GetCPInfo
LocalFree
GlobalLock

user32

wsprintfA
CharUpperA
CharLowerA
DispatchMessageA
TranslateMessage
PeekMessageA
DestroyWindow
DefWindowProcA
GetWindowLongA
PostMessageA
RegisterClassA
UnregisterClassA
MsgWaitForMultipleObjects
SetWindowLongA
CreateWindowExA
wsprintfW
CharToOemA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WinHttpAddRequestHeaders
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpCreateUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetDefaultProxyConfiguration
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
WinHttpWriteData

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

31f9764109fc10779607dc47d4f67963

Headers

File Characteristics

Imports

msvcrt

shlwapi

advapi32

kernel32

user32

Exports

Exports

Sections

.text Size: 273KB - Virtual size: 272KB

.data Size: 2KB - Virtual size: 6KB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 12KB - Virtual size: 12KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 273KB - Virtual size: 272KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 12KB - Virtual size: 12KB

.rmnet
Size: 56KB - Virtual size: 60KB