da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108

Sharing

Copy URL Twitter E-mail

General

Target
da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108
Size 5.2MB
Sample260814-wvftfsbb59
SHA256 da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108
MD5 17adcedb5ba97e8019df816733afcd39
SHA1 7f24a150833b8d946adf05e469e6ef3d0ce660b9
SHA512 8d9f8ef78fc7b1ad67979016c904662e195a1fae582cb24f1159e1a7a811347170b2fdec6f4b94564d84e5a26da705bd901d6436ff7cb2689467d7c1dc1d8c5d
SSDEEP 49152:RkUZHmffhPtiL9Z1/mXmto3G+rDXVaREUlYRbMsxFRNwgDCjzCcTCv9u4fhxeD4:25q8QURNtITCVu4hIxdb
TLSH
T167464B03F2EA4094E0BAD674DF7652329A767C495BF5A0EF228036D81E76BD07738B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108

File Explorer

da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108

.dll 5.2MB

da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108

IMPHASH ebad9b4490cfa1302acb253b2fd20890
SHA256 da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108
MD5 17adcedb5ba97e8019df816733afcd39
SHA1 7f24a150833b8d946adf05e469e6ef3d0ce660b9
SHA512 8d9f8ef78fc7b1ad67979016c904662e195a1fae582cb24f1159e1a7a811347170b2fdec6f4b94564d84e5a26da705bd901d6436ff7cb2689467d7c1dc1d8c5d
SSDEEP 49152:RkUZHmffhPtiL9Z1/mXmto3G+rDXVaREUlYRbMsxFRNwgDCjzCcTCv9u4fhxeD4:25q8QURNtITCVu4hIxdb
TLSH
T167464B03F2EA4094E0BAD674DF7652329A767C495BF5A0EF228036D81E76BD07738B11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2831280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AllocConsole AssignProcessToJobObject CallbackMayRunLong CancelIo CloseHandle CloseThreadpool CloseThreadpoolWork CompareStringOrdinal CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMailslotW CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreW CreateThread CreateThreadpool CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPreferredUILanguages GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessImageFileNameW K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenEventW OpenMutexW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SubmitThreadpoolWork SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WerRegisterRuntimeExceptionModule WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile lstrcmpA lstrcmpiW lstrlenA lstrlenW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetObjectW GetStockObject LineTo MoveToEx RoundRect SelectClipRgn SelectObject SetBkMode SetStretchBltMode SetTextColor

user32

AllowSetForegroundWindow BeginPaint CallNextHookEx CallWindowProcW CharLowerW CharNextW CharUpperW ClientToScreen CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EnableMenuItem EnableWindow EndDialog EndPaint EnumThreadWindows FillRect FindWindowExW GetActiveWindow GetAsyncKeyState GetClientRect GetCursorPos GetDC GetDesktopWindow GetDlgItem GetFocus GetForegroundWindow GetGuiResources GetMessageW GetParent GetQueueStatus GetSystemMenu GetWindow GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InflateRect InvalidateRect IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW LoadStringW MapWindowPoints MessageBoxW MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PtInRect RegisterClassExW RegisterClassW RegisterHotKey ReleaseCapture ReleaseDC ScreenToClient SendInput SendMessageW SendNotifyMessageW SetCapture SetCursor SetFocus SetForegroundWindow SetProcessDPIAware SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassW UnregisterHotKey WaitForInputIdle wsprintfW

advapi32

AccessCheck AdjustTokenPrivileges AllocateAndInitializeSid BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW CheckTokenMembership ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW DuplicateToken EqualSid EventRegister EventUnregister EventWrite FreeSid GetExplicitEntriesFromAclW GetLengthSid GetNamedSecurityInfoW GetTokenInformation GetUserNameW ImpersonateNamedPipeClient InitializeAcl InitializeSecurityDescriptor IsValidSid LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegEnumKeyExW RegEnumValueW RegGetKeySecurity RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo SystemFunction036

shell32

CommandLineToArgvW ord190 ord155 SHBrowseForFolderW SHChangeNotify SHCreateItemFromParsingName SHGetDesktopFolder SHGetFolderPathW SHGetKnownFolderPath SHGetPathFromIDListW SHOpenWithDialog ShellExecuteA ShellExecuteExW ShellExecuteW

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CreateStreamOnHGlobal IIDFromString PropVariantClear StringFromGUID2

msimg32

AlphaBlend GradientFill

comctl32

ord413 ord412 ord410

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipFree GdiplusShutdown GdiplusStartup

dbghelp

MiniDumpWriteDump SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

secur32

GetUserNameExW

wininet

HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetErrorDlg InternetOpenW InternetReadFile InternetSetStatusCallbackW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CryptBinaryToStringW CryptDecodeObject CryptEnumOIDInfo CryptHashCertificate CryptMsgClose CryptMsgGetParam CryptQueryObject

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAResetEvent WSAStartup accept closesocket getsockname ioctlsocket recv recvfrom sendto shutdown

wintrust

WinVerifyTrust

oleaut32

SafeArrayCreate SafeArrayGetVartype SafeArrayPutElement SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysStringByteLen VarUI4FromStr VariantClear VariantInit VariantTimeToSystemTime

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathMatchSpecW SHDeleteKeyW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

propsys

InitPropVariantFromCLSID

winmm

timeBeginPeriod timeEndPeriod timeGetTime

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

680KB

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

160B

Characteristics

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

449B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

70B

Characteristics

Name

CPADinfo

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

726KB

Virtual Size

726KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

da555ff9f7ac82bbe7f2d61ea3626a8f067ed6ed42a8d69c79e660b3b936a108

kernel32

gdi32

user32

advapi32

shell32

ole32

msimg32

comctl32

gdiplus

dbghelp

bcrypt

secur32

wininet

crypt32

ws2_32

wintrust

oleaut32

version

shlwapi

userenv

propsys

winmm

winhttp

generic